Oracle MySQL Server EUVD-2026-106121

No special configuration conditions are stated: per CVSS AV:N/AC:L/PR:N/UI:N, exploitation is remote, unauthenticated, low-complexity, and requires no user interaction against affected MySQL Server/Cluster 26.7.0-26.7.1 instances with network access to the database service over one of the supported connection protocols. The practical limiting factors are: the attacker must have network reachability to the MySQL listener (instances firewalled from untrusted networks are not exposed); only the two specific releases 26.7.0 and 26.7.1 are affected; and impact is confined to partial integrity (unauthorized update/insert/delete to a subset of data) with no read/confidentiality or availability consequence, bounding the damage from a successful attack.

This is a medium-severity, integrity-only flaw (CVSS 3.1 base 5.3) in MySQL Server/Cluster Connection Handling. The vendor-supplied vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N describes easily exploitable, unauthenticated, network-reachable exploitation over multiple protocols, which is the high-risk end of the signal spectrum. However, impact is deliberately narrow: only partial integrity (I:L) with no confidentiality (C:N) and no availability (A:N) impact - successful attacks yield unauthorized update/insert/delete to SOME accessible data, not full compromise. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of 'easily exploitable' + unauthenticated + ubiquitous product argues for prompt patching during the Oct 2026 Oracle CPU cycle, but the low integrity-only impact and absence of exploitation signals mean this is a moderate-priority fix rather than an emergency. Note a tagging conflict: the input Tag 'Authentication Bypass' is not substantiated by the description, which characterizes the issue as a Connection Handling data-integrity flaw, not an auth-bypass - verify the mechanism with Oracle before treating it as a bypass.

A remote, unauthenticated attacker with network reachability to an exposed MySQL Server or Cluster instance (versions 26.7.0-26.7.1) sends crafted traffic over one of the supported connection protocols to abuse a flaw in connection handling. The low-complexity interaction lets them perform unauthorized update, insert, or delete operations against a subset of accessible data, corrupting or tampering with records. No public exploit code is identified at time of analysis, so exploitation would currently require independent development.