MySQL Connector/ODBC CVE-2026-101806

Exploitation targets Oracle MySQL Connector/ODBC version 26.7.1 and requires the attacker to hold low-level privileges (PR:L) and network reachability over one of the multiple supported protocols; no user interaction is needed (UI:N). The principal limiting factor is the high attack complexity (AC:H): success depends on connection/server-state conditions outside the attacker's control, meaning it cannot be reliably triggered against an arbitrary target on demand. Oracle does not document the exact feature or configuration flag involved, so the precise triggering condition is not specified in available data; impact is confined to confidentiality and integrity of connector-accessible data with no availability effect.

This is a moderate-severity issue (CVSS 3.1 base 6.8) that should be patched in Oracle's October 2026 CPU cycle but does not warrant emergency out-of-band response. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) shows network reachability but is tempered by two meaningful brakes: AC:H (high attack complexity - conditions exist outside the attacker's control) and PR:L (the attacker must already hold low-level privileges). Impact is significant where it lands - High confidentiality and High integrity - but there is no availability impact (A:N), so this is a data-disclosure/data-tampering problem rather than a crash/DoS. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no evidence of active or at-scale exploitation; exploitation status is best characterized as no public exploit identified at time of analysis. The SSVC framework cannot be fully populated (no automatable/exploitation-maturity data supplied), but the AC:H + PR:L combination argues against easy automation. One signal to verify: the input Tag 'Authentication Bypass' conflicts with the CVSS, which requires PR:L (an already-privileged actor) and describes data-access compromise rather than any bypass of authentication - treat the tag as suspect pending vendor confirmation. Net: real but not urgent; prioritize in normal patch cadence.

A low-privileged actor on the network who can influence a MySQL Connector/ODBC session (for example via a malicious or compromised endpoint reachable over one of the supported protocols) crafts the specific conditions needed to trigger the flaw and reads or tampers with data accessible through the connector. The high attack complexity means the attacker must line up server/connection conditions outside their direct control, so exploitation is non-trivial. No public exploit code was identified in the provided data.