MySQL Server EUVD-2026-106174

Exploitation requires that the MySQL Group Replication Plugin is actively in use (i.e., the server is configured as part of a Group Replication topology, which is NOT the default for standalone MySQL installations), and that the attacker has access to the physical/layer-2 communication segment attached to the server hardware (AV:A - same VLAN or broadcast domain, not routed internet access). No authentication (PR:N) and no user interaction (UI:N) are needed once adjacency is achieved. The primary limiting factors are therefore network adjacency and the non-default Group Replication configuration; a segmented management network for replication traffic materially reduces realistic exposure.

This is a moderate-priority issue whose real-world risk is tightly bounded by its attack vector rather than its 7.1 CVSS score. The CVSS vector (AV:A/AC:L/PR:N/UI:N) describes an unauthenticated, low-complexity attack, but AV:A (Adjacent) is decisive: the attacker must sit on the same physical/layer-2 communication segment as the server, so this is NOT internet-remote and cannot be sprayed at scale. Impact is a complete DoS (A:H) plus limited unauthorized data modification (I:L), with no confidentiality loss (C:N). No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit was identified, so exploitation-probability signals are entirely absent rather than low - this is missing data, not evidence of safety. The Oracle-sourced Integrity/Availability profile is internally consistent, so there is no CVSS-versus-description conflict to flag. Net: a genuine but situational risk for environments running MySQL Group Replication on shared/flat network segments; for the common single-instance MySQL deployment where Group Replication is not enabled, practical exposure is near zero.

An attacker already positioned on the same local network segment as a MySQL cluster node (e.g., a compromised host or rogue device in the same VLAN/broadcast domain) sends crafted traffic to the Group Replication Plugin without authenticating. The malformed input triggers a hang or repeatable crash, taking the database offline, and can also perform unauthorized insert/update/delete against some accessible data. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means a working exploit would be reliable once developed.