MySQL Router EUVD-2026-37355

The attacker needs only network reachability to a MySQL Router instance's TLS-enabled client port (typically the classic protocol on 6446/6447 or X Protocol on 6448/6449) on a vulnerable 8.4.0-8.4.9 or 9.0.0-9.7.0 build; no authentication, no valid MySQL credentials, and no user interaction are required, consistent with AV:N/AC:L/PR:N/UI:N. Exploitation is limited by network exposure - Routers bound to loopback or to a private cluster VLAN with strict ACLs are not reachable by external attackers - and by version, since deployments already on a patched June 2026 CPU build or pre-8.4.0 legacy lines are out of scope. Impact is bounded to availability of the Router process itself (C:N/I:N/A:H); the backend mysqld instances are not directly compromised, though they lose their routing layer.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is internally consistent with the description: network-reachable, low-complexity, unauthenticated, no user interaction, availability-only impact, base 7.5. Oracle classifies it as 'easily exploitable,' which strengthens the AC:L/PR:N reading. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no current signal of mass exploitation; the realistic risk profile is targeted DOS against exposed Router instances rather than widespread opportunistic attacks. Real-world severity depends heavily on exposure - Routers fronting customer-facing applications or sitting on networks reachable from untrusted clients are materially affected, while Routers bound to private cluster networks are largely shielded; because the bug is reachable via TLS (the typical client interface), even hardened deployments that disable plaintext are still in scope. Note that CISA KEV status, EPSS probability, POC availability, and SSVC decision data were all absent from the input, so risk ranking is inferred from CVSS and Oracle's CPU advisory text only.

An attacker who can reach a MySQL Router TLS listener - for example, a Router exposed on a shared cloud subnet or fronting a public-facing application - opens a TLS connection and sends a crafted payload that triggers the parsing or state-handling defect, causing the Router process to hang or crash and severing all routed application connections to the backend MySQL cluster. Repeating the request keeps the Router unavailable, producing a sustained outage of every application that depends on it; no public exploit code was identified at time of analysis, but Oracle's 'easily exploitable' rating implies the trigger is straightforward once the vulnerable code path is identified.