MySQL Server CVE-2026-47008

Exploitation requires a valid, high-privileged MySQL account (e.g., DBA, root, or an account with sufficient InnoDB-affecting privileges) - this is the primary limiting condition per PR:H in the CVSS vector. Network access to the MySQL Server or Cluster on any supported protocol port is required (AV:N, AC:L). No user interaction is needed. The vulnerability is constrained to MySQL Server and Cluster versions 9.7.0-9.7.1; deployments on other version branches (8.0, 8.4, 9.0-9.6) are not affected per current advisory data. Exploitation is limited by: the requirement for high-level credentials, the narrow affected version range (two point releases of the 9.7 branch), and the absence of a known public exploit. There is no indication that a special non-default configuration is required beyond running an affected version with network access enabled.

The CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) accurately captures the threat profile: network reachable, low complexity, but requiring high privileges - meaning the attacker must already hold DBA-level or equivalent credentials. This PR:H prerequisite is the dominant risk-limiting factor. No EPSS score was provided in the source data, and the vulnerability does not appear in the CISA KEV catalog, indicating no observed active exploitation. No POC code has been identified. The practical real-world risk is moderate: an insider threat or a compromised privileged database account could weaponize this to cause complete availability loss, but opportunistic or unauthenticated mass exploitation is not feasible. Organizations running MySQL 9.7.x with externally reachable database ports and weak credential hygiene face higher residual risk.

A database administrator or an attacker who has compromised a DBA-level credential connects to the MySQL Server over the network using a standard MySQL client or compatible protocol, then issues a crafted InnoDB-targeting query or sequence of operations that triggers a hang or crash loop. Because AC:L and the attack is repeatable, the attacker can sustain the denial-of-service condition indefinitely, preventing legitimate applications from accessing the database. No public proof-of-concept has been identified, but the low attack complexity suggests exploitation would not require advanced MySQL internals knowledge once the triggering input is known.