Oracle MySQL EUVD-2026-106122

Exploitation requires an authenticated attacker already holding HIGH database privileges on the target (CVSS PR:H) - this is the primary limiting factor and means the flaw cannot be triggered by an anonymous or low-privileged user. Given that prerequisite, the attack is network-reachable over multiple standard MySQL protocols (AV:N), needs no user interaction (UI:N), and is low-complexity ('easily exploitable', AC:L) against the Server: Components Services component. Affected deployments are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; versions outside these ranges are not in scope. Impact is limited to availability (hang or repeatable crash / complete DOS) with no confidentiality or integrity effect, so the realistic risk reduces to insider misuse or an attacker who has already captured a privileged account.

This is a genuine-but-moderate-priority issue, not a top-tier emergency. The CVSS 3.1 score is 4.9 (Medium) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - the only impact is Availability (A:H), with no confidentiality or integrity loss. The AV:N and AC:L metrics mean the attack is network-reachable and low-complexity ('easily exploitable'), but PR:H is the decisive limiter: the attacker must already hold high database privileges. In practice this reduces the realistic threat to a malicious or compromised privileged account (e.g. a DBA-level or application account with elevated rights) rather than an anonymous internet attacker. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit identified, so there are no exploitation-probability or active-exploitation signals to elevate this above its base score. There is no SSVC decision data in the input. Signals are internally consistent (description, Oracle's own CVSS, and the DoS tag all agree it is a privileged availability-only flaw), so no contradictions require vendor verification. Bottom line: a legitimately-scored Medium DoS whose real-world urgency hinges almost entirely on how well privileged MySQL accounts are controlled.

An attacker who already possesses a high-privilege MySQL account - for example a compromised DBA credential or an over-privileged application service account - connects over the network using one of the supported MySQL protocols and issues a crafted request to the Server: Components Services component. The request triggers a hang or repeatable crash, producing a complete denial of service of the MySQL Server or Cluster node. No public exploit has been identified at time of analysis.