MySQL Connector/J CVE-2026-61082

A legitimate Java application or user must actively initiate a MySQL database connection through MySQL Connector/J version 9.7.0 or 9.7.1 - this is the UI:R (user interaction required) condition without which the attack cannot proceed. The attacker must be network-positioned to intercept or interfere with traffic between the Java application and the MySQL server; while AC:L indicates no special race conditions or configuration states are needed, achieving a man-in-the-middle network position is itself a prerequisite that limits casual exploitation. The vulnerability applies across 'multiple protocols,' meaning it is not restricted to a specific MySQL connection mode. Exploitation is strictly limited to confidentiality - integrity (data modification) and availability (denial of service) are unaffected. The vulnerability does not appear to require any non-default configuration setting, though restricting network path access to the database layer would functionally block the attack.

The CVSS 3.1 score of 6.5 (Medium) reflects AV:N/AC:L/PR:N/UI:R with a High confidentiality impact and no integrity or availability impact. The 'easily exploitable' Oracle qualifier is notable - it implies low attack complexity in practice, consistent with the AC:L vector. However, UI:R is a meaningful constraint: exploitation depends on a legitimate application or user initiating a connection through the flawed connector, making purely opportunistic bulk scanning less viable than for UI:N vulnerabilities. No EPSS score is available in the provided data, and the vulnerability is not listed in the CISA KEV catalog, meaning active widespread exploitation is not confirmed. No public POC has been identified. Despite the moderate CVSS score, operational risk is elevated for deployments where Connector/J 9.7.x transmits credentials or sensitive database contents across networks where an attacker could achieve a man-in-the-middle position. The Authentication Bypass tag implies credential interception is plausible, which amplifies downstream risk beyond the raw CVSS score suggests. The absence of integrity and availability impact means this is a targeted data theft vector rather than a destructive or denial-of-service risk.

An attacker with a man-in-the-middle position on the network path between a Java application and its MySQL server - achieved via ARP spoofing on a shared LAN, DNS hijacking, or compromised network infrastructure - waits for the application to initiate a database connection through the affected Connector/J 9.7.0 or 9.7.1 driver. The authentication bypass flaw allows the attacker to intercept or spoof the connection handshake without valid credentials, granting unauthorized read access to all data transmitted over the session, including credentials, query results, and sensitive database contents. No public exploit code is known at time of analysis, but Oracle's 'easily exploitable' characterization suggests exploitation does not require advanced tooling once network positioning is achieved.