MySQL Server CVE-2026-61128

Exploitation requires a valid high-privileged MySQL account (consistent with PR:H in the CVSS vector) with network connectivity to the MySQL Server or Cluster instance on port 3306 or equivalent. The attacker must hold DBA-level or SUPER-equivalent MySQL privileges sufficient to reach the Optimizer code path through query submission. No special non-default server configuration is required - the Optimizer is active in default MySQL deployments. Exploitation is NOT achievable by unauthenticated users or low-privileged MySQL accounts (e.g., application service accounts with only SELECT/INSERT/UPDATE), and no user interaction is required (UI:N). The vulnerability is version-scoped to MySQL Server and MySQL Cluster 9.7.0-9.7.1 only; organizations not running this precise version range are not affected by this specific CVE.

Real-world risk is moderate and bounded primarily by the PR:H constraint. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) accurately characterizes the situation: the attack is network-reachable with low complexity and no user interaction, but requires high-privilege MySQL credentials - typically DBA-level or SUPER privilege - to reach the vulnerable Optimizer code path. This limits the threat actor pool to insiders, compromised administrator accounts, or attackers who have already achieved privileged database access through a prior step. The availability impact is rated High (A:H) with no confidentiality or integrity impact, meaning the worst-case outcome is a complete database outage rather than data exfiltration or corruption. No EPSS score was provided in source data, and the absence of a CISA KEV listing and absence of reported public exploit code further deprioritizes this relative to other high-CVSS Oracle vulnerabilities. The descriptor 'easily exploitable' from Oracle's advisory reflects the AC:L rating but must be read in the context of the PR:H prerequisite - exploitation is only 'easy' for those already holding privileged credentials. This is most relevant as a post-compromise denial-of-service risk or an insider threat scenario.

An attacker who has obtained high-privileged MySQL credentials - through credential theft, insider access, or as a post-compromise step following initial access via another vector - connects to the MySQL Server or Cluster over the network and submits a specially crafted SQL query designed to trigger a defect in the Optimizer component. The server either hangs indefinitely or crashes completely, denying service to all applications dependent on the database. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) implies that once the triggering query pattern is discovered or disclosed, reliable exploitation would be straightforward for any holder of high-privileged MySQL credentials.