Oracle MySQL EUVD-2026-106128

Exploitation requires an authenticated, high-privilege MySQL account (PR:H) - the attacker must already be able to authenticate with elevated database privileges, so this is not remote-unauthenticated. The flaw lives in the Server: Replication component and is reachable over MySQL's network protocols (AV:N, 'multiple protocols') with no user interaction (UI:N) and low attack complexity (AC:L) once privileged access exists. The primary limiting factor is the privilege prerequisite, which restricts realistic exploitation to malicious insiders or attackers who have already compromised a privileged credential; impact is confined to availability (crash/hang DOS) of the affected 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 Server builds and the corresponding Cluster builds (including 8.0.0-8.0.49).

This is a genuine-but-low-priority availability flaw, not a top-tier emergency. The CVSS 3.1 score is 4.9 (Medium), driven entirely by availability impact (C:N/I:N/A:H) with no confidentiality or integrity loss. The vector (AV:N/AC:L/PR:H/UI:N/S:U) shows network-reachable, low-complexity exploitation, but critically requires high privileges (PR:H) - the attacker must already possess a high-privilege database account, which sharply limits the realistic threat population to insiders or attackers who have already compromised privileged credentials. The description's 'easily exploitable' phrasing (matching AC:L) conflicts somewhat with the real-world barrier of PR:H; the ease applies only once privileged access is held. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' The absence of KEV/EPSS data is expected for a freshly disclosed Oracle CPU item and should not be read as either safe or dangerous. Net: a high-privileged attacker can crash/hang the database (complete DOS of that instance), but the privilege barrier plus DoS-only impact keeps this well below the priority of RCE or unauthenticated flaws. Patch via the October 2026 Oracle CPU on a normal maintenance cadence.

An attacker who already holds a high-privilege MySQL account (e.g., a replication or admin user, or a compromised service credential) connects to the server over one of its supported network protocols and issues a crafted request against the Server: Replication component. The malicious input triggers a hang or repeatable crash, producing a complete denial of service of the MySQL Server or Cluster node until it is restarted. No public exploit code has been identified at the time of analysis.