Oracle MySQL EUVD-2026-106021

Exploitation requires the attacker to already hold high (administrative/DBA-level) privileges on the target MySQL Server or MySQL Cluster instance (CVSS PR:H), reachable over the network via one of several supported database protocols. The trigger is a crafted operation handled by the Server: DDL component. Limiting factors: the high-privilege prerequisite sharply narrows the realistic attacker set to malicious insiders or adversaries who have already compromised a privileged database account; impact is limited to availability (hang/crash), with no confidentiality or integrity effect and no user interaction required. Affected: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a genuinely medium/low-priority issue despite affecting ubiquitous software. The CVSS 3.1 base score is 4.9 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - the single mitigating factor that caps severity is PR:H, meaning the attacker must already hold high (administrative/DBA-level) privileges on the MySQL Server or Cluster instance. Impact is confined to availability (A:H) with no confidentiality or integrity loss; the outcome is a hang or repeatable crash (complete DOS). Oracle's phrasing 'easily exploitable' corresponds to the AC:L (low attack complexity) and AV:N (network, multiple protocols) metrics, but 'easy' here is conditioned on the attacker already possessing the required high privilege. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or probable exploitation. The practical risk is that of a privileged insider or an attacker who has already compromised a DBA account degrading database availability - not a mass-exploitable remote threat. CWE is reported as N/A, so the precise defect class is unconfirmed.

An attacker who has already obtained high-privilege (DBA-level) credentials on a MySQL Server or Cluster instance connects over the network and issues a specially crafted DDL operation that drives the server into a hang or repeatable crash, producing a complete denial of service. No public exploit code is identified at the time of analysis, and the attack yields no data disclosure or modification - only availability loss.