MySQL Server EUVD-2026-106015

Exploitation requires an authenticated attacker already holding HIGH MySQL privileges (CVSS PR:H) with network access to the database via one of its supported protocols; it targets the Server: Optimizer component in MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The dominant limiting factor is the high-privilege prerequisite: an unprivileged or anonymous user cannot trigger it, which substantially narrows the realistic threat to insiders or compromised privileged accounts. Impact is limited to a hang or repeatable crash (complete DoS); no confidentiality or integrity effect applies.

This is a moderate-severity, availability-only issue that does not warrant emergency prioritization. The Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, base 4.9) is internally consistent: network-reachable and low-complexity, but gated behind PR:H - the attacker must already hold high database privileges. Impact is confined to availability (C:N/I:N/A:H): a hang or repeatable crash producing complete DoS of the server, with no data exposure or integrity loss. No EPSS score, KEV listing, POC, or SSVC decision data was provided; absence of KEV/POC is expected for a freshly disclosed Oracle Critical Patch Update item and should not be read as 'safe.' The practical risk ceiling is low because an attacker who already has high MySQL privileges can typically disrupt the database by simpler means, so this adds limited incremental capability. The description's phrase 'easily exploitable' refers only to AC:L and does not contradict the PR:H requirement. Treat as routine patch-cycle remediation, not an out-of-band emergency.

A user holding high database privileges (e.g., a compromised application or administrative account) connects over a supported MySQL protocol and submits a crafted query that the Server Optimizer component mishandles, causing the server to hang or crash repeatedly and producing a complete denial of service. No public exploit code has been identified at the time of analysis, and no data confidentiality or integrity is affected. Because the flaw requires high privileges, realistic abuse implies an insider or an already-compromised privileged credential.