MySQL Server EUVD-2026-46731

Exploitation requires a high-privilege authenticated position on the target (CVSS PR:H) plus network reachability to the MySQL X Plugin / X Protocol interface (mysqlx, default port 33060), and the X Plugin must be enabled. The affected component is Server: X Plugin on MySQL Server 8.4.0-8.4.10 / 9.7.0-9.7.1 and MySQL Cluster 8.0.0-8.0.47 / 8.4.0-8.4.10 / 9.7.0-9.7.1. Limiting factors that reduce realistic risk: the PR:H requirement means an unauthenticated or low-privilege attacker cannot exploit it, so the practical threat is a compromised or malicious high-privilege account; deployments that disable the X Plugin or block port 33060 from untrusted networks remove the reachable attack surface. No user interaction is required (UI:N).

The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - network-reachable, low complexity, no user interaction, but requiring high privileges (PR:H) and yielding full C/I/A impact. The dominant limiting factor is PR:H: the attacker must already hold high-privilege credentials or an equivalently trusted role, which materially reduces real-world risk and reframes this largely as a privilege-escalation-to-takeover or compromised-account scenario rather than an anonymous internet attack. No EPSS score, KEV entry, POC, or SSVC decision was supplied, so exploitation probability cannot be quantified from the data; the absence of KEV combined with the PR:H prerequisite suggests this is not a mass-exploitation candidate. The 'Information Disclosure' tag is inconsistent with the description's emphasis on full takeover (C:H/I:H/A:H) - treat the tag as a partial classification and rely on the CVSS impact metrics, which indicate impact well beyond disclosure.

An attacker who has obtained high-privilege MySQL credentials (for example via a compromised admin account or an over-privileged application service account) connects over the network to the X Plugin interface and issues crafted X Protocol requests that abuse the vulnerable component to gain full control of the database server. Given AC:L and no required user interaction, the operation is low-complexity once the privileged connection is established and results in complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis.