Oracle MySQL Server EUVD-2026-106154

Exploitation requires the affected RAPID (HeatWave analytics) component to be in use within MySQL Server or MySQL Cluster versions 9.7.0-9.7.3 or 26.7.0-26.7.1, and the attacker must already hold high-level database privileges (PR:H) and have network access over one of the supported MySQL protocols. The vulnerability is explicitly difficult to exploit (AC:H), implying dependence on specific server state, timing, or crafted input conditions rather than a trivial trigger. Limiting factors that reduce realistic risk: the high privilege prerequisite means only an already-trusted/authenticated actor can exploit it, there is no user-interaction vector that broadens reach to end users, and impact is confined to availability with no data exposure or modification.

This is a low-to-moderate real-world priority despite being in a ubiquitous product. The CVSS 3.1 base score is only 4.4, and the vector (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) establishes meaningful barriers: although the attack vector is network-based over multiple protocols, exploitation is explicitly 'difficult' (AC:H) and requires a high-privileged attacker (PR:H) who already holds elevated database privileges. The only impact is availability (A:H) - a hang or repeatable crash (complete DoS) - with no confidentiality or integrity consequence. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The combination of high complexity, high required privilege, and availability-only impact means an attacker able to exploit this already has substantial authorized access, limiting the marginal risk. The signals are internally consistent (no conflict between CVSS vector and description), so the main caveat is simply the absence of EPSS/exploitation telemetry rather than contradictory data.

An attacker who already possesses high-privileged credentials on a MySQL Server or Cluster instance running the affected RAPID (HeatWave) component connects over the network via one of several supported protocols and issues a specially crafted sequence that triggers a hang or repeatable crash, producing a complete denial of service. Because the flaw is rated difficult to exploit (AC:H), reliable triggering likely requires specific timing, state, or query conditions. No public exploit code is identified at time of analysis.