MySQL Router EUVD-2026-106040

Exploitation requires luring a user other than the attacker into interacting with attacker-controlled content delivered to MySQL Router over HTTPS (UI:R in the vector); the attack is remote and needs no authentication or prior privileges (AV:N, PR:N) against the affected MySQL Router 26.7.0. The decisive limiting factor is the mandatory human interaction - the flaw cannot be triggered by the attacker alone - and the impact is capped at unauthorized read of only a subset of MySQL Router data, with no write/integrity or availability effect, meaningfully lowering realistic risk despite the network, unauthenticated reachability.

This is a moderate-severity information-disclosure issue, not a top-tier priority. The CVSS 3.1 base score is 4.3 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - network-reachable and unauthenticated (PR:N) with low attack complexity, but gated by required user interaction (UI:R) and limited to low-impact unauthorized read of a subset of MySQL Router data (C:L, no integrity or availability impact). No EPSS score was provided in the input, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so all three exploitation-pressure signals are either absent or negative. There is no SSVC decision data supplied. Note a conflict worth flagging: the input Tags include 'Authentication Bypass,' but neither the description nor the CVSS vector supports that characterization - the vulnerability yields read access to a subset of data, not an authentication bypass, and PR:N simply means no privileges are needed to attempt the attack, not that authentication is circumvented. Bottom line: a genuine but low-urgency confidentiality flaw whose real-world risk is further reduced by the UI:R requirement; patch during normal Oracle CPU cycles rather than as an emergency.

An unauthenticated attacker crafts malicious content delivered over HTTPS and lures a victim (a person other than the attacker) into interacting with it, causing MySQL Router to disclose a subset of its accessible data back to the attacker. No public exploit code is identified at time of analysis, and the required human interaction plus low confidentiality-only impact make opportunistic mass exploitation unlikely.