MySQL Server CVE-2026-61144

Exploitation requires that the attacker hold high-privileged MySQL credentials with network access to the target MySQL Server or Cluster instance running version 9.7.0 or 9.7.1. The triggering action is a crafted SQL query processed by the Server: Optimizer component, which is active in all standard MySQL deployments - no non-default configuration is required to expose the vulnerable code path. The CVSS PR:H metric is the primary limiting factor: low-privilege authenticated users and unauthenticated network attackers cannot trigger this vulnerability. The attack can be delivered over any protocol supported by MySQL (TCP/IP, named pipes, etc.). Scope is unaffected (S:U), meaning the crash is confined to the MySQL process and does not propagate to the host OS or other services.

The CVSS 3.1 base score of 4.9 is moderate and appropriately reflects the significant limiting factor: the attacker must already hold high-privileged database credentials (PR:H). Without those credentials, exploitation is not possible. Attack complexity is low (AC:L) and no user interaction is required (UI:N), meaning that a privileged attacker faces no additional barrier once access is established. The impact is purely availability (A:H - complete crash or hang of the server), with zero confidentiality or integrity exposure (C:N/I:N). No EPSS score was provided, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed active exploitation. No POC is known. Despite Oracle's 'easily exploitable' language, real-world prioritization should be guided by the PR:H gate: this is most relevant to insider threat scenarios, compromised privileged accounts (e.g., leaked DBA credentials), and multi-tenant environments where application-tier accounts hold elevated DB privileges. For environments with strict privilege separation and network-level controls on MySQL access, actual risk is low.

An attacker who has obtained high-privileged MySQL credentials - whether through credential theft, insider access, or compromise of an application tier with elevated DB rights - connects to a MySQL Server 9.7.x instance over the network and submits a crafted SQL query that exercises a vulnerable code path in the Optimizer. The server enters a hang state or crashes, causing a complete availability outage for all connected clients and dependent applications. No public POC is known, but Oracle's 'easily exploitable' designation suggests the trigger query is not difficult to construct.