Oracle MySQL CVE-2026-47052

Exploitation requires a high-privileged database account (equivalent to DBA or SUPER privilege level, as indicated by CVSS PR:H) with network connectivity to the MySQL Server or MySQL Cluster management interface. The vulnerability is reachable via multiple protocols, meaning standard MySQL client protocols (including the classic MySQL protocol on TCP/3306 and the X Protocol on TCP/33060, as well as MySQL Cluster's NDB management ports) are all potential vectors. No special non-default configuration is described as a prerequisite - the affected component (InnoDB) is the default and mandatory storage engine in these MySQL versions. What limits exploitation: the high-privilege requirement (PR:H) means unauthenticated attackers or low-privileged database users cannot trigger this flaw; the attacker must first acquire administrative database credentials. There is no confidentiality or integrity pre-condition (C:N/I:N in scope). The vulnerability does not affect MySQL Server 8.0.x outside of the Cluster product line based on current CPE data.

The CVSS 3.1 base score of 4.9 (Medium) is principally depressed by the PR:H (high privilege) requirement, which accurately reflects that only database administrators or users with elevated database grants can trigger the flaw. The AV:N and AC:L metrics confirm the attack is network-reachable with no special timing or race condition required, and UI:N means no victim interaction is needed once the attacker has authenticated. The S:U (unchanged scope) and C:N/I:N signals indicate no lateral movement or data exfiltration potential - this is a pure availability threat. No EPSS data was provided in the source intelligence; given the absence of KEV listing and no public POC, real-world exploitation probability should be considered low at this time. However, insider threat scenarios or compromised DBA credentials could make this directly actionable. The 'easily exploitable' language in Oracle's advisory description - a specific Oracle severity qualifier - suggests the triggering condition is straightforward once privilege requirements are met, which means the complexity is front-loaded onto credential acquisition, not exploit development. Overall: legitimate medium priority for organizations running affected MySQL versions with internet-exposed or multi-tenant database instances, but not a top-tier emergency absent credential exposure.

An attacker who has obtained high-privilege MySQL credentials - for example, through credential stuffing against an exposed database management interface, insider access, or lateral movement from a compromised application server - connects to the MySQL Server or Cluster node over the network using any supported protocol (TCP/IP, X Protocol, or Cluster management protocols) and issues crafted operations targeting the InnoDB engine. The crafted request triggers a hang or crash of the MySQL process, causing database unavailability for all connected clients. Because the Oracle advisory characterizes this as 'frequently repeatable,' the attacker can re-trigger the condition after any automatic restart, sustaining the denial-of-service.