MySQL Connector/J EUVD-2026-106169

Exploitation targets MySQL Connector/J 26.7.0 specifically and, consistent with AC:H, is not a straightforward remote hit against a default listener: the realistic prerequisite is that the attacker controls, compromises, or can man-in-the-middle the MySQL server endpoint that a Java application using the driver connects to, so that a malicious/crafted server response is processed by the vulnerable driver. Limiting factors: only version 26.7.0 is listed as affected (upgrade/downgrade removes exposure), the 'Difficult to exploit' (AC:H) rating implies additional attacker-uncontrolled conditions must be met, and the application must actually initiate a connection to an attacker-influenced endpoint - pure internet-facing unauthenticated mass exploitation is unlikely despite PR:N/UI:N. Oracle does not disclose the exact feature or configuration flag involved.

This is a serious-on-paper but exploitation-constrained issue. The CVSS 3.1 base score is 8.1 (HIGH) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning network-reachable, unauthenticated (PR:N), no user interaction, and full confidentiality/integrity/availability loss ('takeover'). The single most important mitigating signal is AC:H - Oracle's own wording 'Difficult to exploit' - which indicates the attacker does not control all preconditions and must win a non-trivial, situation-dependent condition. No EPSS score was supplied, no CISA KEV listing is present, and no public exploit is indicated, so there is no public exploit identified at time of analysis; this is not evidence of active exploitation. No SSVC decision data was provided. Signals are therefore consistent rather than conflicting: a high technical impact tempered by genuine exploitation difficulty and no observed in-the-wild activity. Note a metadata discrepancy to verify: the input Tag labels this 'Information Disclosure', yet the description and CVSS (C:H/I:H/A:H, 'takeover') describe full compromise, not mere disclosure - treat the impact as full takeover per Oracle's own CVSS.

Connector/J is MySQL's JDBC client driver, so the realistic path is server-to-client: an attacker who controls or can MITM the MySQL endpoint a Java application connects to returns a crafted protocol response that the driver mishandles, leading to compromise of the client application. The AC:H rating reflects that the attacker must first be positioned as (or intercept) the database server and satisfy additional conditions, which is why it is rated difficult. No public exploit code is identified at time of analysis.