Oracle MySQL Server EUVD-2026-106163

Exploitation requires an authenticated low-privileged MySQL account (PR:L) with network access via one of multiple supported protocols to reach the Server: Security: Encryption component; it is not exploitable by fully unauthenticated attackers. Oracle explicitly rates it 'difficult to exploit' (AC:H), meaning success depends on specialized conditions or timing beyond the attacker's direct control rather than a single deterministic request. Impact is confined to availability - a hang or frequently repeatable crash causing complete DOS - with no path to data disclosure or modification. Limiting factors that reduce realistic risk: valid credentials are mandatory, attack complexity is high, and only Availability is affected. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a medium-severity (CVSS 3.1 base 5.3) availability-only vulnerability in Oracle MySQL Server / MySQL Cluster. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) tells a consistent story: network-reachable but high attack complexity (AC:H) and requiring an already-authenticated low-privileged account (PR:L), with impact limited strictly to availability (complete DOS via hang or repeatable crash) and no confidentiality or integrity loss. No EPSS score was provided in the input, and there is no CISA KEV listing or public exploit indicated, so exploitation status is 'no public exploit identified at time of analysis.' The combination of high complexity plus required authentication meaningfully lowers real-world risk relative to the 5.3 score: this is not a mass-exploitable, unauthenticated RCE but a DoS requiring a valid account and favorable conditions. For internet-exposed MySQL instances with untrusted low-privilege users (e.g., shared hosting, multi-tenant DBaaS), it warrants patching in the normal Oracle CPU cycle; for internally segmented databases it is lower priority. No signals conflict here - all point to a moderate, authenticated DoS. Missing data: no EPSS, no CWE (listed N/A), and the Oracle CPU advisory URL is the only primary source.

A low-privileged attacker who already holds valid MySQL credentials (or has compromised an application's database account) connects over the network via one of the supported protocols and sends specially crafted input to the Server: Security: Encryption component. Because the flaw is difficult to exploit (AC:H), the attacker may need specific timing or repeated attempts, but a successful attack hangs or repeatedly crashes the server, producing a complete denial of service. No public proof-of-concept or active exploitation is identified at time of analysis.