MySQL Server EUVD-2026-46746

Exploitation requires local logon access to the physical or virtual infrastructure where MySQL Server or MySQL Cluster is running - remote network exploitation is not possible per the AV:L CVSS vector. The attacker must possess high privileges (PR:H), consistent with a DBA-level MySQL account or an OS-level privileged user (e.g., root, mysql system user, or equivalent). Attack complexity is rated High (AC:H), indicating specific conditions within the replication subsystem must be present - likely involving active replication configuration, particular binlog or replication thread state, or a timing-sensitive code path not reproducible in default-idle configurations. Exploitation is further limited by: absence of remote attack vector eliminating network-based exploitation, high privilege requirement excluding low-privilege or guest accounts, high complexity requiring environmental conditions beyond attacker control, and unchanged scope (S:U) meaning no inherent escalation to adjacent systems beyond the MySQL instance itself. These combined constraints make opportunistic or automated exploitation highly unlikely.

The CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) encodes meaningful exploitation barriers: the attacker must have local logon access to the server infrastructure, hold high database or OS-level privileges, and reproduce a high-complexity condition specific to the replication component. These constraints substantially limit the realistic attacker population to insiders, compromised privileged accounts, or post-exploitation scenarios where an attacker has already gained a foothold. The complete CIA impact (H/H/H) is significant, but scope remains unchanged (S:U), meaning no inherent lateral movement is implied. No EPSS data was provided, making probabilistic exploitation likelihood assessment impossible from available data. KEV status is absent - this vulnerability is not confirmed as actively exploited. No POC is publicly known. Overall, this is a real but constrained risk: organizations with strict privileged access management, strong OS-level controls, and separation of DBA duties face materially lower exposure. Multi-tenant or shared hosting environments where multiple parties hold privileged database access face elevated risk. The 6.4 score is technically appropriate given the barriers, but the H/H/H impact warrants prioritized patching in sensitive deployments.

An attacker with an already-compromised DBA account or OS-level privileged access to the MySQL host - whether through insider threat, credential theft, or a prior exploitation step - triggers a difficult-to-reproduce condition within the MySQL replication subsystem. Under the right environmental state (AC:H), this results in full control of the MySQL Server or Cluster instance, allowing the attacker to exfiltrate all database contents, manipulate replication streams to corrupt replica data, or disrupt service availability. No public proof-of-concept exists at time of analysis, making this scenario most realistic for sophisticated, targeted actors operating post-initial-compromise.