CVE-2026-101774
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Vulnerability in MySQL Server and MySQL Cluster (component Server: Pluggable Auth) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A difficult-to-exploit network attack by an unauthenticated user can cause a hang or frequently repeatable crash (complete DoS) and unauthorized update, insert or delete access to some data.
Risk Assessment
An unauthenticated attacker can remotely crash the database and modify some data, impacting integrity and availability.
Recommendation
Update MySQL Server and MySQL Cluster to a fixed version and restrict network access to the database.
Other vulnerabilities in MySQL Server
See all- CVE-2026-101637Medium
Vulnerability in MySQL Server and MySQL Cluster (component InnoDB) versions 9.7.0-9.7.3 and 26.7.0-26.7.1. It allows a high-privileged attacker with network access via multiple protocols to cause a hang or frequently repeatable crash (complete DoS) and unauthorized modification of some data.
- CVE-2026-101629Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster in the same versions. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS) of the server or cluster.
- CVE-2026-101627Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS), although exploitation is difficult.
- CVE-2026-101624Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101623Medium
A vulnerability in Oracle MySQL (Server: Optimizer component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101622Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101621Medium
A vulnerability in Oracle MySQL (InnoDB component) affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. A high-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101620Medium
A vulnerability in Oracle MySQL (Server: Optimizer component) affects MySQL Server 9.7.0-9.7.3 and MySQL Cluster 9.7.0-9.7.3. A low-privileged attacker with network access can cause a hang or frequently repeatable crash (complete DoS).
- CVE-2026-101619Medium
Vulnerability in MySQL Server and MySQL Cluster (InnoDB component) allows a high-privileged attacker with network access to cause a hang or frequently repeatable crash (complete DoS) of the server. Affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.
- CVE-2026-101618Medium
Vulnerability in MySQL Server and MySQL Cluster (InnoDB component) allows a high-privileged attacker with network access to cause a hang or frequently repeatable crash (complete DoS) of the server. Affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1 and MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1.
Original NVD description (English source)
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS