CVE-2026-101732 Oracle Corporation CVE debrief

Who should care

MySQL Server and MySQL Cluster administrators and users should assess exposure and apply patches or updates to affected versions. This includes reviewing the affected versions and applying patches or updates to prevent high-privileged attackers with network access from causing a hang or crash of the MySQL Server or MySQL Cluster.

Why it matters

CVE-2026-101732 is a medium-severity vulnerability in MySQL Server and MySQL Cluster that allows high-privileged attackers with network access to cause a hang or crash of the MySQL Server or MySQL Cluster. MySQL Server and MySQL Cluster administrators should assess exposure and apply patches or updates to affected versions.

• Potential for high-privileged attackers to cause a hang or crash of MySQL Server or MySQL Cluster.
• Need for MySQL Server and MySQL Cluster administrators to assess exposure and apply patches or updates.

Technical summary

The vulnerability is in the Server: Optimizer component of MySQL Server and MySQL Cluster. It has a CVSS score of 4.9 and can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. The vulnerability affects multiple versions of MySQL Server and MySQL Cluster, including MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster.

Defensive priority

Medium priority for MySQL Server and MySQL Cluster administrators to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure of MySQL Server and MySQL Cluster instances to this vulnerability.
• Apply patches or updates to affected versions of MySQL Server and MySQL Cluster.
• Monitor MySQL Server and MySQL Cluster instances for potential crashes or hangs.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD vulnerability detail provide information on the affected versions and CVSS score. The vulnerability affects multiple versions of MySQL Server and MySQL Cluster. Defenders should verify the affected scope and apply patches or updates to affected versions. The CVE record was published on 2026-10-20T22:18:28.077Z and has not been modified since then. The information provided is based on the CVE record and NVD vulnerability detail.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.