MySQL Server EUVD-2026-106156

Exploitation requires the attacker to already possess low-privileged authenticated access (PR:L) to MySQL Server or MySQL Cluster versions 26.7.0 through 26.7.1, reachable over one of the supported network protocols. The flaw resides in MySQL client programs and yields only a denial of service (server hang or repeatable crash). Limiting factors: valid credentials are mandatory (not remotely unauthenticated), attack complexity is high (AC:H) implying specific preconditions or timing must be met, and only the narrow 26.7.0-26.7.1 release branch is affected. No confidentiality or integrity compromise is possible, and no user interaction is required (UI:N).

This is a moderate-severity, availability-only flaw (CVSS 3.1 base 5.3) in MySQL Server/Cluster client programs. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) tells a consistent story: network-reachable but with high attack complexity (AC:H) and requiring low-privileged authentication (PR:L), yielding only a denial of service (hang or repeatable crash) with no confidentiality or integrity impact. No EPSS score, SSVC decision, KEV listing, or POC was supplied in the intelligence set, so exploitation probability cannot be quantified - no public exploit identified at time of analysis. The combination of AC:H and PR:L materially lowers real-world risk versus the raw score: an attacker must already hold valid (even if low-privilege) credentials and satisfy non-trivial preconditions, which makes opportunistic mass exploitation unlikely. This is a patch-in-normal-cycle issue (addressed in Oracle's October 2026 Critical Patch Update) rather than an emergency; the primary concern is availability for multi-tenant or internet-exposed MySQL deployments where even authenticated users should not be able to crash the server. Note the only reference is the Oracle CPU advisory plus an NVD/EUVD mirror - CWE is listed as N/A and no root-cause detail is provided, so the specific defect class is unknown.

A low-privileged user who already holds valid MySQL credentials connects over one of the supported network protocols and issues a specially crafted sequence of client-program interactions that triggers the flaw, causing the server to hang or enter a frequently repeatable crash (complete DOS). Because attack complexity is high, success depends on meeting specific preconditions or timing, so exploitation is not reliably one-shot. No public exploit code or active exploitation has been identified in the provided data.