MySQL Server EUVD-2026-106131

Exploitation requires an authenticated session with HIGH privileges (PR:H) on MySQL Server or MySQL Cluster, reachable over the network via MySQL's supported protocols, and the ability to drive the Server: Optimizer component with a malicious query. There is no user-interaction requirement (UI:N) and complexity is low (AC:L), but the need for a pre-existing high-privilege account is the decisive limiting factor - an unauthenticated or low-privileged remote attacker cannot trigger it. Impact is limited to availability (hang or repeatable crash / complete DoS); no data disclosure or modification occurs. Affected deployments are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a moderate-severity denial-of-service issue in the MySQL Server Optimizer component, and the signals consistently point to limited real-world urgency rather than a top priority. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, base 4.9) confirms a network-reachable, low-complexity attack but one that requires HIGH privileges (PR:H) and yields only an availability impact - no confidentiality or integrity loss. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no evidence of active or probable exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' The signals do not conflict: a PR:H-gated DoS reported through Oracle's routine Critical Patch Update (cpuoct2026) is a defense-in-depth fix for an already-authenticated high-privilege user, not a mass-exploitation threat. The main caveat is that Oracle's description labels it 'easily exploitable' yet simultaneously requires a high-privileged account - the practical barrier is obtaining those credentials, which substantially limits the attacker population. Prioritize via normal Oracle CPU patch cadence rather than emergency response.

An attacker who already holds a high-privileged MySQL account (e.g., a compromised application service account or malicious DBA) connects over the network via one of MySQL's supported protocols and submits a crafted query that triggers a flaw in the Optimizer, causing the server to hang or repeatably crash. The result is a complete denial of service for MySQL Server/Cluster. No public exploit code was identified in the provided data, and no user interaction is required beyond the authenticated session.