Oracle MySQL Server EUVD-2026-106016

Exploitation requires an authenticated low-privilege MySQL account (PR:L) with network access to the database over any of its supported protocols, targeting the Server: Optimizer component via crafted queries - there is no unauthenticated or UI-dependent path. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1. The key limiting factor is the credential requirement: an attacker must already possess valid login access, so realistic risk is concentrated in multi-tenant, shared, or application-facing databases where low-privilege accounts are exposed to semi-trusted parties; impact is limited strictly to availability (no data disclosure or modification).

This is a moderate-priority, availability-only vulnerability - not a confidential-data or code-execution threat. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with Oracle's 'easily exploitable' / 'low privileged attacker with network access' / 'complete DOS' narrative: low attack complexity, network reachable, requires a low-privilege authenticated account, and impacts only availability (C:N/I:N/A:H). No EPSS score, CISA KEV listing, or public POC is present in the provided intelligence, and there is no CWE classification. The absence of KEV/EPSS/POC signals, combined with the fact that this is one of many flaws disclosed in a scheduled Oracle Critical Patch Update (October 2026) rather than an emergency out-of-band fix, points to a routine-patch priority rather than active, widespread exploitation. The single most important limiting factor contradicting a 'drop everything' response is PR:L - an attacker must already hold a valid (even minimal) MySQL account, so this is primarily an insider / post-foothold / compromised-credential risk against the database tier, not an open-internet unauthenticated DOS. Real priority should be driven by whether the MySQL instance is multi-tenant or exposed to semi-trusted authenticated users; for such deployments it is a genuine availability concern, whereas for tightly-scoped single-application databases it is lower urgency.

An attacker holding a low-privilege MySQL account (e.g., a compromised application credential or a semi-trusted tenant on a shared instance) sends specially crafted queries that trigger a flaw in the Server Optimizer while planning execution, causing the server to hang or repeatably crash and taking the database offline (complete DOS). Because attack complexity is low and no user interaction is needed, the attack is reliably repeatable once a valid login is obtained. No public exploit code is identified at time of analysis.