MySQL Server EUVD-2026-106190

Exploitation requires a valid low-privilege MySQL account (PR:L) with network reachability to the database over one of the supported MySQL protocols; it does not require administrative rights or user interaction. The attack targets the Server: Optimizer component, so it is triggered by query processing rather than a special non-default configuration. Limiting factors: the attacker must first authenticate (so unauthenticated internet exploitation is not possible), and the impact is restricted to availability - no data is read or modified. Risk is therefore concentrated on multi-tenant, shared, or externally reachable instances where untrusted or compromisable low-privilege accounts exist.

This is a moderate-severity availability-only vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, but the impact is confined entirely to availability (C:N/I:N) - a hang or repeatable crash producing complete denial of service of the MySQL Server/Cluster process. Oracle's own description reinforces the vector by calling it 'easily exploitable' by a 'low privileged attacker with network access via multiple protocols,' which is consistent with AC:L/PR:L. No EPSS score, SSVC decision data, or CWE classification is provided in the input, so exploitation probability and automatability cannot be quantified. There is no CISA KEV listing and no public exploit identified at the time of analysis, so there is no evidence of active or widespread exploitation. On balance this is a real but bounded priority: it matters most for internet-exposed or multi-tenant database instances where an authenticated low-privilege user (or any account an attacker can obtain) can repeatedly crash the service, but it does not threaten data confidentiality or integrity and carries no confirmed exploitation signal.

A user holding a low-privilege MySQL account (for example an application service account on a shared or internet-facing database) connects over any supported MySQL protocol and submits a specially crafted query that the Optimizer component mishandles, causing the server to hang or crash. Repeating the query produces a reliable, complete denial of service for all tenants of that instance. No public proof-of-concept has been identified, and the attack requires valid (low-privilege) authentication.