MySQL Server EUVD-2026-106171

The flaw is in MySQL Server/Cluster 'Client programs' (client utilities/libraries), so exploitation realistically requires a MySQL client to connect to an attacker-controlled or attacker-influenced server/endpoint over one of the multiple supported protocols; the unauthenticated network vector (PR:N) applies to that client-server interaction rather than to a directly exposed listening service. The dominant limiting factor is high attack complexity (AC:H) - Oracle labels it a 'Difficult to exploit' vulnerability - meaning the attacker must satisfy additional conditions (e.g., coercing or racing the client into connecting to the malicious endpoint) beyond merely reaching the target. No user-interaction flag is set (UI:N) and no authentication is required (PR:N), but the practical precondition of a victim client initiating a connection to a hostile endpoint constrains opportunistic mass exploitation. Affected: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

CVSS 3.1 base score is 8.1 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, so the headline severity is driven by full confidentiality, integrity and availability impact (C:H/I:H/A:H, 'takeover') reachable by an unauthenticated network attacker (PR:N). The single strongest mitigating signal is AC:H ('Difficult to exploit vulnerability'), which materially reduces real-world likelihood. No EPSS score, SSVC decision, KEV listing, or POC reference is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a high-CVSS issue whose practical priority is tempered by high attack complexity and absence of exploitation signals. Note also a cross-source conflict: the input Tag 'Information Disclosure' understates the impact, since the CVSS vector and description indicate full takeover (C:H/I:H/A:H), not read-only disclosure - treat the impact as full compromise. Because the component is 'Client programs,' the AV:N/PR:N vector most plausibly describes a malicious-server-attacks-client model rather than a directly internet-exposed service; verify the exact trigger with Oracle's CPU advisory. Overall: patch on the normal Oracle Critical Patch Update cadence; this is a credible but not emergency-grade priority given AC:H and no exploitation evidence.

A MySQL client program (or application using the client libraries) connects over one of multiple supported protocols to a server or endpoint controlled or influenced by the attacker, who returns crafted responses that exploit the client-side flaw to compromise the client host. Because attack complexity is high (AC:H), the attacker must win a race, control intermediate conditions, or coerce the victim into connecting to the malicious endpoint. No public exploit identified at time of analysis.