Oracle MySQL Server EUVD-2026-106175

Exploitation targets the MySQL Server 'Server: Pluggable Auth' component and is reachable by an unauthenticated attacker (PR:N) over the network via multiple MySQL connection protocols, so no credentials or user interaction are required (UI:N). The primary limiting factor is high attack complexity (AC:H): Oracle rates it 'difficult to exploit,' implying success depends on specific server state, timing, or race conditions the attacker does not control rather than a special non-default configuration. Affected deployments are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; risk is concentrated where the MySQL network port is exposed to untrusted networks, and is reduced where access is restricted to trusted application hosts by firewall/network segmentation.

This is a moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 base score is 6.5 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - network-reachable and unauthenticated (PR:N), but with high attack complexity (AC:H), meaning exploitation requires specific conditions or timing that the attacker does not fully control. The dominant impact is Availability (A:H, complete DOS via hang or repeatable crash) with limited Integrity impact (I:L, some unauthorized update/insert/delete) and no Confidentiality impact (C:N). No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit code is referenced - no public exploit identified at time of analysis. Oracle itself characterizes the flaw as 'difficult to exploit,' which aligns with AC:H. Net: the network+unauthenticated reach warrants timely patching of internet- or application-exposed MySQL instances, but the high complexity and DOS-centric (not RCE, not data-theft) impact keep this below critical priority. No conflicting signals were found between the CVSS vector and the description; both agree on unauthenticated network access with high complexity and availability-dominant impact.

An unauthenticated attacker with network access to a MySQL Server or Cluster instance sends specially crafted traffic over one of the supported connection protocols targeting the pluggable authentication component, triggering a hang or repeatedly reproducible crash that takes the database completely offline (denial of service) and in some cases allows limited unauthorized modification of accessible data. Exploitation is rated difficult (AC:H), so success likely depends on specific timing or server state the attacker cannot fully control. No public proof-of-concept exploit was identified at time of analysis.