MySQL Server CVE-2026-47012

Exploitation requires: (1) network connectivity to the MySQL Server or Cluster instance via any supported protocol (MySQL Wire Protocol, X Protocol, or other supported interfaces); (2) authentication with a high-privilege database account - such as a DBA or account holding SUPER, SYSTEM_VARIABLES_ADMIN, or equivalent administrative grants; and (3) the ability to craft a query or input that triggers the specific optimizer code path (AC:H indicates a non-trivial, condition-dependent trigger). Limiting factors: the attacker cannot be unauthenticated - PR:H is required; the attack path is difficult to reproduce without prior knowledge of the trigger condition; impact is limited to availability only, with no data exfiltration or modification possible. This vulnerability cannot be exploited by standard application-level database users with restricted privileges, limiting the realistic threat to insiders, compromised administrative accounts, or lateral movement scenarios where an attacker has already obtained DBA credentials.

The CVSS 3.1 score of 4.4 (Medium) accurately reflects constrained real-world risk. The vector AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H reveals three important limiting factors: the attacker must already hold high-privilege database credentials (PR:H), exploitation requires a specific and non-trivial trigger condition (AC:H), and the sole impact is availability - there is no confidentiality or integrity exposure. No EPSS score was provided in the available intelligence, and neither KEV status nor public proof-of-concept code has been identified, meaning this is classified as no public exploit identified at time of analysis. For most production environments, this vulnerability does not warrant emergency patching; it should be addressed in the next scheduled Oracle CPU maintenance window. Organizations where MySQL uptime is critical (e.g., high-traffic transactional systems) should prioritize patching sooner given the A:H availability impact. The primary realistic threat is a malicious or compromised DBA, not an external attacker.

A database administrator or a compromised account holding high-privilege MySQL grants connects to a vulnerable MySQL Server or Cluster instance over the network and submits a specially constructed SQL query designed to trigger a specific code path in the Optimizer subsystem. The server enters an unrecoverable hang or crashes repeatedly, causing a complete denial of service for all dependent applications. No public exploit code is known at time of analysis, and successful exploitation requires the attacker to identify the precise optimizer trigger condition (AC:H).