MySQL Cluster EUVD-2026-106170

Exploitation requires TCP network access to a MySQL Cluster node running affected versions 26.7.0 or 26.7.1, targeting the Cluster: General component; no authentication and no user interaction are needed (PR:N/UI:N). The key limiting factor is high attack complexity (AC:H) - Oracle explicitly labels this 'difficult to exploit,' meaning the attacker must meet specific conditions or timing beyond the attacker's direct control rather than being able to fire a single reliable request. Practical exposure is further bounded by whether the cluster's data/management network is reachable from untrusted networks; MySQL Cluster is typically deployed on segmented internal networks, which narrows the realistic attacker population.

This is a genuinely moderate-priority issue rather than a top-tier emergency, and the signals are largely consistent. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) describes a network-reachable, unauthenticated flaw, which raises concern, but the AC:H (high attack complexity - Oracle's own 'difficult to exploit' language) materially lowers real-world likelihood of opportunistic mass exploitation. The dominant impact is availability (A:H = complete DOS via hang or repeatable crash), with only limited confidentiality and integrity impact (C:L/I:L - unauthorized read of a subset and unauthorized update/insert/delete to some data). No EPSS score was supplied, so exploitation probability cannot be quantified from the input. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed to be actively exploited. No SSVC decision data was provided. The one point worth verifying: the description states 'Difficult to exploit' yet pairs it with an unauthenticated network vector - the net effect is that while an attacker needs no credentials, they must overcome specific conditions or timing to succeed, which keeps practical risk below the raw 7.0 score. Treat this as a standard patch-cycle priority for MySQL Cluster operators, elevated where the cluster is internet- or untrusted-network-reachable.

An unauthenticated attacker with TCP network reach to a MySQL Cluster node sends specially crafted traffic to the Cluster: General component to trigger a hang or repeatable crash, producing a complete denial of service, and in some cases achieving limited unauthorized read or modification of cluster-accessible data. Because the CVSS vector marks AC:H, the attacker must satisfy non-trivial conditions or timing, so success is not guaranteed on a single attempt. No public proof-of-concept or exploit code has been identified at time of analysis.