CVE-2026-101678 Oracle Corporation CVE debrief

Who should care

Defenders of MySQL Connectors deployments, specifically those using version 26.7.0, should assess exposure and prioritize patching or mitigations. Defenders should verify affected versions and exposure, and monitor for potential DOS attacks due to the vulnerability in Connector/J component. Security teams and vulnerability management teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

Defenders of MySQL Connectors should assess exposure, prioritize patching or mitigations, and monitor for potential DOS attacks due to the vulnerability in Connector/J component.

• Potential partial denial of service (DOS) attacks
• Need for human interaction to exploit the vulnerability
• Requires verification of affected versions and exposure

Technical summary

The vulnerability in MySQL Connectors' Connector/J component allows unauthenticated attackers with network access to cause a partial DOS, requiring human interaction. The vulnerability affects version 26.7.0 and has a CVSS 3.1 Base Score of 4.3 (Availability impacts). Successful attacks require human interaction from a person other than the attacker and can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. Defenders should assess exposure and prioritize patching or mitigations.

Defensive priority

Apply vendor patches or mitigations to prevent potential DOS attacks

Recommended defensive actions

• Review and apply Oracle's security advisory for MySQL Connectors
• Verify and update MySQL Connectors to a non-affected version if available
• Monitor for potential DOS attacks and implement network access controls
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and Oracle advisory provide details on the vulnerability and affected version 26.7.0. The vulnerability has a CVSS 3.1 Base Score of 4.3 (Availability impacts) and a CVSS Vector of (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Defenders should verify affected versions and exposure. The CVE record was published on 2026-10-20T21:22:16.065Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.