MySQL Server CVE-2026-46936

Exploitation requires a high-privileged database account (such as a DBA or root-equivalent MySQL user) with network reachability to the target MySQL Server or MySQL Cluster instance via any supported MySQL protocol. The CVSS AC:H designation indicates that beyond credentials and network access, additional prerequisites must align - likely a specific server state, a precise DDL statement structure, or a race condition during schema operations. There is no indication in the available data that non-default configuration is required; the DDL component is active in standard deployments. Exploitation is concretely limited by: (1) the requirement for high-privileged DB credentials (PR:H), ruling out unauthenticated or low-privilege attack paths; (2) high attack complexity (AC:H), meaning reliable exploitation requires specific conditions not trivially reproducible; and (3) the impact being exclusively availability - no data disclosure or write path exists through this vector.

The CVSS 3.1 base score of 4.4 (Medium) accurately reflects a constrained real-world threat. Three independent limiting signals converge: (1) Attack Complexity is High (AC:H), meaning exploitation is not straightforward and likely requires specific server state or precise DDL crafting; (2) Privileges Required is High (PR:H), gating exploitation behind administrative-level database credentials; and (3) the impact scope is exclusively availability (C:N/I:N/A:H), ruling out data exfiltration or integrity attacks. No EPSS score was provided in the intelligence data - real-world exploitation probability cannot be quantified. This CVE does not appear in the CISA KEV catalog and no POC has been identified, meaning exploitation risk is theoretical and not observed in the wild. The combination of high privilege requirement and high attack complexity makes opportunistic exploitation implausible; the realistic threat is a malicious insider, a compromised DBA account, or accidental triggering during complex DDL workloads. This is a maintenance-window patch priority, not an emergency response.

An attacker who has obtained high-privileged MySQL credentials - whether through credential theft, insider access, or lateral movement - connects to the MySQL Server or Cluster instance over the network and submits a specially crafted DDL statement (such as a malformed ALTER TABLE or CREATE operation) that triggers a server hang or crash under specific, difficult-to-reproduce conditions. The database becomes unavailable until manually restarted, causing service disruption for all dependent applications.