MySQL Server EUVD-2026-106177

Exploitation requires that the MySQL Server or MySQL Cluster instance is running with the Group Replication plugin active (the vulnerable component: Server: Group Replication Plugin), i.e. a multi-node replicated/clustered deployment rather than a standalone server. The attacker must also already possess high database privileges (CVSS PR:H) and network reachability via one of MySQL's supported protocols. Standalone MySQL instances not using Group Replication are not in the exploitable path, and the high-privilege requirement limits the attack to trusted or already-compromised privileged accounts. Impact is limited to availability (hang/repeatable crash); there is no confidentiality or integrity effect.

This is a moderate-severity, high-CVSS-does-not-apply case: the CVSS 3.1 base score is only 4.9 (MEDIUM), driven entirely by an availability impact (C:N/I:N/A:H). The vector AV:N/AC:L/PR:H/UI:N shows network-reachable, low-complexity exploitation, but PR:H means the attacker must already hold high database privileges, which is the dominant risk-limiting factor. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or probable exploitation; per the input this is 'no public exploit identified at time of analysis.' Although Oracle's description says 'easily exploitable,' that phrasing refers to attack complexity (AC:L), not to a lack of privilege requirement - the PR:H requirement sharply narrows the realistic attacker population to insiders or those who have already compromised a privileged account. There is no SSVC decision data and no CWE mapping supplied. Net assessment: a genuine denial-of-service bug worth patching during normal Oracle Critical Patch Update cycles, but not an emergency given the high-privilege precondition, availability-only impact, and absence of any exploitation signal.

An attacker who has already obtained high database privileges on a MySQL Server or MySQL Cluster node running the Group Replication plugin connects over the network and issues crafted input to the Group Replication component, causing the server to hang or repeatedly crash (complete DOS). No public exploit code is identified at the time of analysis, and the attack produces no data disclosure or modification - only loss of availability.