Oracle MySQL EUVD-2026-106186

Exploitation requires an authenticated low-privileged MySQL account (PR:L) with network access via one of MySQL's supported protocols; it targets the Server JSON component, so interaction with JSON data types/functions is the likely trigger. No user interaction is needed and attack complexity is low. The primary limiting factor is the authentication requirement: the attacker must already possess or compromise valid database credentials, which restricts realistic exploitation to malicious insiders, tenants on shared/multi-tenant MySQL deployments, or attackers who have already harvested database credentials. Affected scope is MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.

This is a genuine high-priority database vulnerability, not an inflated high-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, base 8.3) describes a network-reachable, low-complexity flaw that needs only low privileges and no user interaction, with high integrity and availability impact plus limited confidentiality exposure - a serious combination for a core data store. Oracle's own text reinforces this by calling it 'easily exploitable,' which aligns with AC:L. However, several key signals are MISSING: there is no EPSS exploitation-probability score, no CISA KEV listing, and no evidence of public POC code, so exploitation likelihood cannot be quantified from the input. The barrier is authentication - PR:L means an attacker must already hold a valid low-privileged MySQL account (or compromise one), which meaningfully narrows the threat to insiders, tenants on shared/multi-tenant database services, or attackers who have already obtained database credentials. Net: treat as high priority for patching given MySQL's footprint and the strong integrity/availability impact, but recognize there is no current evidence of active exploitation or weaponization.

An attacker holding a low-privileged MySQL account (for example, a tenant on a shared database host or an application service account) connects over the network via a standard MySQL protocol and submits crafted input that abuses the Server JSON component. This lets them modify or delete critical data and trigger a repeatable crash or hang (complete DoS) of the server. No public exploit code has been identified at time of analysis, and no user interaction is required.