Oracle MySQL CVE-2026-61094

Exploitation requires the attacker to already hold high MySQL privileges (CVSS PR:H) - an administrative/replication-capable account - plus network reachability to the target's MySQL client or replication protocols; the vulnerable code path is the Server: Replication component of MySQL Server 8.4.x/9.7.x or MySQL Cluster 8.0.x/8.4.x/9.7.x. No user interaction is needed (UI:N) and complexity is low (AC:L), but the high-privilege prerequisite is the primary limiting factor, confining realistic abuse to insiders, compromised admin credentials, or a chain from a prior escalation. The affected versions are specific maintenance ranges (8.4.0-8.4.10, 9.7.0-9.7.1, and Cluster 8.0.0-8.0.47), so instances outside those ranges are not in scope.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2 High) describes a network-reachable, low-complexity attack that requires high privileges (PR:H) and no user interaction, yielding complete C/I/A compromise ('takeover') without scope change. Practical risk is bounded by the PR:H requirement: the attacker must already hold high database privileges (e.g., replication/administrative rights), limiting the viable attacker population to insiders or holders of compromised privileged credentials - which is why this scores 7.2 rather than critical despite full-takeover impact. No EPSS score, KEV listing, SSVC decision, or POC was provided; there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a data conflict worth verifying: the intelligence feed tag labels this 'Information Disclosure', yet both the description and the vector assert full integrity and availability impact and 'takeover' - treat the tag as an imprecise feed label and rely on the CVSS C:H/I:H/A:H signal.

An attacker who has obtained a high-privileged MySQL account - for example through credential theft or as a malicious insider - connects over the network to an unpatched MySQL Server or Cluster node and issues crafted operations against the replication component, escalating from privileged database access to full takeover of the server. No user interaction and only low attack complexity are required, but the pre-existing high-privilege foothold is essential. No public proof-of-concept was identified at time of analysis.