MySQL Server EUVD-2026-106123

Exploitation requires the attacker to already possess a low-privilege authenticated MySQL account (CVSS PR:L) and network reachability to the MySQL Server or MySQL Cluster listener over one of the supported protocols; the flaw resides in the Server connection-handling component. It affects MySQL Server and MySQL Cluster versions 9.7.0-9.7.3 and 26.7.0-26.7.1 only. Limiting factors: valid credentials are mandatory (unauthenticated attackers cannot exploit it), impact is confined to reading a subset of accessible data with no write or denial-of-service capability, and deployments on unaffected versions or with the database not network-exposed are not reachable.

This is a medium-severity, confidentiality-only issue (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) that should be treated as routine patching rather than an emergency. The CVSS vector indicates network-reachable, low-complexity exploitation, but it explicitly requires existing low-level privileges (PR:L), and impact is limited to unauthorized read access to a subset of data (C:L) with no integrity or availability impact. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no signal of active or imminent exploitation. One conflict must be flagged: the input Tags include 'Authentication Bypass', but both the Oracle description and the CVSS vector (PR:L, C:L only, I:N) describe an authenticated low-privilege information-disclosure flaw, NOT an authentication bypass - the tag appears mislabeled and should not drive prioritization. EPSS and KEV data are simply absent (not low), so exploitation probability is unquantified rather than confirmed-low. Net: a real but modest-priority confidentiality bug best handled in the normal Oracle CPU cycle.

An attacker who already holds a low-privilege MySQL account connects over the network via one of the supported protocols to a vulnerable MySQL Server or Cluster node and abuses a flaw in connection handling to read a subset of data they should not be able to access. No user interaction or elevated privileges are needed, but the attacker must first be authenticated at a low level. No public exploit code is identified at time of analysis.