CVE-2026-101774 Oracle Corporation CVE debrief

Who should care

MySQL Server and MySQL Cluster administrators and users, as well as security teams and vulnerability management teams responsible for these products, should assess exposure and apply patches according to the Oracle advisory. They should also review compensating controls and monitor for potential attacks.

Why it matters

The vulnerability allows an unauthenticated attacker with network access to cause a hang or crash of the server, as well as unauthorized access to some accessible data. MySQL Server and MySQL Cluster administrators should assess exposure and apply patches.

• Potential hang or crash of MySQL Server and MySQL Cluster
• Unauthorized access to some accessible data
• Need to verify exposure and apply patches

Technical summary

The vulnerability is in the Server: Pluggable Auth component of MySQL Server and MySQL Cluster. Affected versions are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The vulnerability allows an unauthenticated attacker with network access to cause a hang or crash of the server, as well as unauthorized access to some accessible data. It has a CVSS score of 6.5 and is difficult to exploit. MySQL Server and MySQL Cluster administrators should assess exposure and apply patches.

Defensive priority

Medium priority for MySQL Server and MySQL Cluster administrators to assess exposure and apply patches

Recommended defensive actions

• Assess exposure of MySQL Server and MySQL Cluster instances
• Apply patches for affected versions
• Monitor for potential attacks
• Review and update access controls
• Verify exposure according to Oracle advisory
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD vulnerability detail provide information on the affected versions and CVSS score. Oracle advisory provides information on the vulnerability. The vulnerability is in the Server: Pluggable Auth component. MySQL Server and MySQL Cluster administrators should verify exposure and apply patches according to the Oracle advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.