MySQL Connector/Net EUVD-2026-106034

Affects only MySQL Connector/Net version 26.7.0. As a client-side .NET connector library, exploitation realistically requires the attacker to control or impersonate the MySQL server the connector communicates with (a malicious/compromised server or an on-path/MITM position), consistent with the AC:H rating that marks this as difficult to exploit; it is not a direct remote hit against a passively listening service. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the high-complexity preconditions and the single affected version significantly limit the realistic exploitation window. Impact is confined to unauthorized disclosure of connector-accessible data (no integrity or availability effect).

This is a moderate-priority issue that scores CVSS 3.1 5.9 (Medium) with the vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - network-reachable and unauthenticated (PR:N), but gated by high attack complexity (AC:H) and limited to confidentiality impact only (C:H, I:N, A:N). The high complexity is the key limiting signal: Oracle explicitly labels it 'difficult to exploit,' and because Connector/Net is a client-side .NET library, realistic exploitation generally depends on the connector being induced to talk to a malicious or MITM'd MySQL endpoint rather than a straightforward remote strike against a listening service. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or imminent exploitation; the practical urgency is therefore well below what the 'network/unauthenticated' portion of the vector might suggest in isolation. Note a tag conflict: the input Tags include 'Authentication Bypass,' but the description characterizes the flaw as unauthorized read access to critical data, not a bypass of authentication - verify the vulnerability class with Oracle before treating it as an auth-bypass. Prioritize patching in the normal Oracle CPU cycle rather than as an emergency.

An attacker positioned to control or impersonate a MySQL server endpoint (e.g., via a rogue/compromised server or man-in-the-middle on the connection path) coaxes a .NET application using MySQL Connector/Net 26.7.0 to connect to it. Exploiting the high-complexity flaw, the attacker reads critical data accessible to the connector without authenticating. No public exploit code was identified at the time of analysis, and the AC:H rating indicates the preconditions are non-trivial to satisfy.