MySQL Server EUVD-2026-106176

Exploitation targets the Server: Replication component of MySQL Server (8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1) and MySQL Cluster (8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1), reachable remotely over 'multiple protocols' per Oracle, with no authentication required (PR:N) and no user interaction (UI:N). The decisive LIMITING factor is high attack complexity (AC:H): Oracle explicitly labels it 'difficult to exploit,' implying dependence on specific server state, timing, or race conditions in replication handling rather than a trivially repeatable request. Realistic exposure is confined to database nodes whose network ports are reachable by the attacker; databases bound to localhost or isolated behind strict network segmentation are not reachable. The exact replication configuration or feature needed to trigger the flaw is not specified in the available advisory data and should be verified with Oracle.

This is a genuine but second-tier priority. The CVSS 3.1 base score of 7.4 is driven by an unauthenticated network vector (AV:N/PR:N/UI:N) combined with high integrity and availability impact (I:H/A:H), but it is materially tempered by high attack complexity (AC:H), which Oracle itself flags in the description as 'difficult to exploit.' There is NO confidentiality impact (C:N) - this is a data-tampering and denial-of-service issue, not a data-theft one. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation or weaponization. The only tags are 'Denial Of Service' and 'Oracle,' consistent with the A:H impact. Net: the raw score looks alarming, but AC:H plus no public exploit, no KEV, and no confidentiality loss means this is a patch-in-normal-cycle issue for most operators rather than an emergency - unless the server is internet-exposed and replication is in use, in which case the DoS and data-integrity risk warrants prioritization. No SSVC decision data was provided in the input and cannot be inferred.

A remote, unauthenticated attacker with network reachability to a MySQL Server or MySQL Cluster node sends crafted traffic over one of the supported protocols targeting the Replication subsystem, exploiting a difficult-to-trigger flaw to tamper with or destroy replicated data or to force a repeatable crash (complete DoS) of the database. Because attack complexity is high (AC:H), success likely depends on specific timing or server state, and no public proof-of-concept exploit is referenced in the available data.