Oracle MySQL EUVD-2026-106083

No special conditions beyond network reachability - Oracle states exploitation is by an unauthenticated attacker with network access via multiple protocols against affected MySQL Server (8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1) and MySQL Cluster (8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1), consistent with AV:N/AC:L/PR:N/UI:N. The primary limiting factors are: (1) impact is restricted to availability only (hang/crash, complete DOS) with no data confidentiality or integrity exposure, and (2) the attacker must have network path to the MySQL listening port(s), so deployments that firewall the database from untrusted networks, bind to localhost, or place it behind access controls materially reduce exposure. Patching to the October 2026 CPU fixed versions removes the condition entirely.

This is a genuine but bounded-priority issue: a confidentiality/integrity-safe availability flaw (CVSS:3.1 7.5, A:H only, C:N/I:N) in Oracle MySQL Server and MySQL Cluster, disclosed via the Oracle October 2026 Critical Patch Update. The CVSS signals are consistent and favorable to an attacker - AV:N (network), AC:L (low complexity), PR:N (unauthenticated), UI:N (no user interaction), scope unchanged - and Oracle's own prose reinforces this with 'Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols.' However, the impact ceiling is strictly denial of service (hang or repeatable complete crash), so this cannot be chained into data theft or code execution on its own. No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization: exploitation status is 'no public exploit identified at time of analysis.' Net: prioritize patching for availability-sensitive/internet-exposed MySQL deployments because the barrier to abuse is low and MySQL is near-ubiquitous, but in the absence of KEV/EPSS/POC signals this ranks below CVEs with equivalent CVSS that also carry confidentiality/integrity impact or confirmed exploitation. One data caveat: Oracle lists the affected component as 'Client programs' yet describes server/cluster compromise via network and multiple protocols - verify the precise affected surface with Oracle before scoping.

An unauthenticated attacker with network reachability to a MySQL Server or Cluster listener sends crafted traffic over one of the supported protocols, triggering a hang or repeatable crash that takes the database offline (complete DOS). No credentials or user interaction are required, and Oracle rates it 'easily exploitable,' so repeated requests can keep the service down. No public exploit code was identified in the provided data.