MySQL Server CVE-2026-61109

Exploitation requires a valid MySQL user account with at least low privileges (PR:L per CVSS) - anonymous or unauthenticated access is not sufficient. The attacker must have network access to the MySQL server on at least one supported protocol (standard TCP/3306 or X Protocol/33060). The affected component is the JSON subsystem, so the exploit path involves sending JSON-related SQL operations (e.g., use of JSON functions or JSON column operations). No non-default configuration is required beyond the JSON feature being in use, which is enabled by default in all affected versions. Exploitation is limited to MySQL Server 8.4.x and 9.7.x and MySQL Cluster 8.0.x, 8.4.x, and 9.7.x; MySQL Server 8.0.x standalone is not listed as affected, which limits exposure for that release line.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the primary risk: a network-reachable, low-complexity denial-of-service requiring only low-privilege credentials. The attack complexity is low and no user interaction is required, meaning any valid database account - including read-only or application service accounts - is sufficient to trigger the crash repeatedly. EPSS data is not available in the provided intelligence, but the combination of AC:L, PR:L, and 'easily exploitable' language from Oracle's advisory indicates the barrier to exploitation is minimal for any insider or compromised application account. There is no confidentiality or integrity impact (C:N/I:N), so the risk is purely operational: database unavailability. The vulnerability is not in CISA KEV and no POC has been identified, suggesting opportunistic exploitation is not yet occurring. However, for MySQL Cluster deployments in high-availability environments, the 'frequently repeatable crash' characteristic means an attacker can sustain a DoS even after automatic failover/restart, which elevates operational severity beyond what the base CVSS score alone conveys. MySQL Server 8.0.x is notably absent from the MySQL Server affected list (only Cluster 8.0.x is affected), which may reduce exposure for large numbers of older MySQL 8.0 standalone deployments.

An attacker who has obtained a low-privilege MySQL account - for example, a read-only reporting user or a compromised application service account - connects to the MySQL Server over the standard client protocol and submits a specially crafted JSON-related SQL statement targeting the vulnerable JSON component. The server enters a hang or crashes completely, causing denial of service to all connected clients. Because the crash is described as 'frequently repeatable,' the attacker can sustain the outage by reconnecting and re-issuing the trigger query after each server restart.