MySQL Server CVE-2026-101803

Exploitation requires an authenticated attacker holding HIGH database privileges (PR:H) with network access to MySQL Server or MySQL Cluster over one of the supported protocols; the malicious input targets the Server: XML component. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factor is the high-privilege prerequisite, which confines realistic exploitation to insiders, compromised privileged accounts, or chained post-authentication attacks rather than unauthenticated remote attackers; confidentiality is not impacted.

This is a moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 base score is 6.5 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, meaning network-reachable and low-complexity but gated behind PR:H - the attacker must already hold high database privileges. Impact is limited to Integrity (I:H) and Availability (I:H: unauthorized data modification/deletion and complete DOS), with no confidentiality exposure (C:N). There is no CISA KEV listing, no POC reported, and no EPSS score supplied in the input, so exploitation status is 'no public exploit identified at time of analysis' - all three exploitation signals are either negative or absent and are mutually consistent (no conflict). No SSVC decision data was provided. The key mitigating factor is PR:H: a 'high privileged attacker' (per Oracle's description) already has substantial access, which bounds real-world risk to insider/post-compromise abuse or a chained scenario rather than mass external exploitation. The Oracle phrase 'easily exploitable' refers only to low attack complexity (AC:L), not to lack of authentication. Note the CWE is listed as N/A, so the precise flaw class in the Server: XML component is not confirmed from the input.

An attacker who already holds high database privileges (e.g., a malicious or compromised DBA-level account) connects over the network via a supported MySQL protocol and submits crafted input to the Server: XML component. This triggers unauthorized modification or deletion of critical data, or a repeatable crash producing a complete denial of service of MySQL Server/Cluster. No public exploit code was identified at the time of analysis, and no user interaction is required.