CVE-2026-101772
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Vulnerability in MySQL Server and MySQL Cluster (component: Client programs) affecting versions 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49. A difficult-to-exploit flaw allows an unauthenticated attacker with network access to take over the MySQL server.
Risk Assessment
Takeover of the database server can result in full compromise of confidentiality, integrity and availability of data.
Recommendation
Apply the Oracle patch for client programs and server as soon as possible and restrict network access to database services.
Other vulnerabilities in MySQL Server
See all- CVE-2026-101637Medium
Vulnerability in MySQL Server and MySQL Cluster (component InnoDB) versions 9.7.0-9.7.3 and 26.7.0-26.7.1. It allows a high-privileged attacker with network access via multiple protocols to cause a hang or frequently repeatable crash (complete DoS) and unauthorized modification of some data.
- CVE-2026-101629Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster in the same versions. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS) of the server or cluster.
- CVE-2026-101627Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS), although exploitation is difficult.
- CVE-2026-101624Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101623Medium
A vulnerability in Oracle MySQL (Server: Optimizer component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101622Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101621Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101620Medium
A vulnerability in Oracle MySQL (Server: Optimizer component) affects MySQL Server 9.7.0-9.7.3 and MySQL Cluster 9.7.0-9.7.3. A low-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101619Medium
Vulnerability in MySQL Server and MySQL Cluster (InnoDB component) allows a high-privileged attacker with network access to cause a hang or frequently repeatable crash (complete DoS) of the server. Affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.
- CVE-2026-101618Medium
Vulnerability in MySQL Server and MySQL Cluster (InnoDB component) allows a high-privileged attacker with network access to cause a hang or frequently repeatable crash (complete DoS) of the server. Affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.
Original NVD description (English source)
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS