MySQL Server EUVD-2026-106181

Exploitation requires network reachability to the MySQL X Plugin (the X Protocol interface, which the component name 'Server: X Plugin' identifies - typically listening on TCP 33060) and a low-privileged authenticated account (CVSS PR:L), with no user interaction. Oracle describes it as easily exploitable via 'multiple protocols'. Limiting factors: the X Plugin / mysqlx must be enabled and network-exposed (it is commonly enabled by default on recent 8.x+ builds but is frequently firewalled off from untrusted networks), and the attacker needs at least low-level credentials; impact is confined to availability (a hang or repeatable crash / complete DoS) with no path to data access or code execution. Affected: MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

All signals point to a moderate, availability-only risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) describes a network-reachable, low-complexity attack requiring only low privileges (PR:L) and no user interaction, with impact limited entirely to availability (A:H; C:N/I:N) - a complete DoS via hang or repeatable crash, with no data disclosure or integrity loss. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only source is Oracle's own CPU advisory. The practical risk is therefore an authenticated availability threat rather than a widespread or weaponized one: a low-privileged database user (or any account that can reach the X Plugin) could crash the server, which matters for multi-tenant or internet-exposed MySQL deployments but is not a confidentiality/integrity breach. Note the conflict that CVSS marks PR:L (some authentication) while Oracle's prose calls it 'easily exploitable' and mentions 'multiple protocols' - verify exposure of the X Protocol (port 33060) with the vendor, as default configurations may or may not enable it. SSVC framing: exploitation=none observed, automatable likely (network DoS), technical impact=partial (availability only).

An attacker holding a low-privileged MySQL account, or who can otherwise reach the MySQL X Plugin endpoint (X Protocol, typically TCP 33060) over the network, sends a crafted request that triggers a hang or repeatable crash in the Server: X Plugin component. This results in a complete denial of service of the MySQL Server/Cluster instance; the attack is low-complexity and needs no user interaction, but no public exploit code is identified at time of analysis.