CVE-2026-101775 Oracle Corporation CVE debrief

Who should care

MySQL Server and MySQL Cluster administrators, Database security teams, IT security teams responsible for patch management, and operators managing affected versions of MySQL Server and MySQL Cluster. These teams must identify affected instances, apply Oracle security patches, and implement compensating controls to mitigate potential unauthorized data modifications and service disruption.

Why it matters

CVE-2026-101775 is a high-severity vulnerability in MySQL Server and MySQL Cluster that requires immediate attention from administrators and security teams. The vulnerability allows for potential unauthorized data modifications and service disruption. Affected versions need to be identified, and Oracle security patches should be applied as a priority. The vulnerability's impact on data integrity and service availability necessitates swift action to prevent potential exploitation.

• Potential unauthorized data modifications
• Service disruption due to complete DOS
• Need for verification of affected versions and exposure
• Priority for applying Oracle security patches

Technical summary

The vulnerability, located in the Server: Replication component of MySQL Server and MySQL Cluster, allows an unauthenticated attacker with network access to potentially compromise the server. Successful exploitation could lead to unauthorized data modifications and service disruption. Affected versions include MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1.

Defensive priority

High priority for MySQL Server and MySQL Cluster administrators

Recommended defensive actions

• Review and apply the Oracle security patch for CVE-2026-101775
• Conduct an inventory check to identify affected MySQL Server and MySQL Cluster instances
• Implement compensating controls to monitor and restrict network access to MySQL services
• Verify the integrity of data and monitor for potential unauthorized modifications
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its high CVSS score of 7.4 and the potential impacts on data integrity and service availability. The vulnerability's impact on data integrity and service availability necessitates swift action to prevent potential exploitation. Affected versions need to be identified, and Oracle security patches should be applied as a priority. The CVE Program record and NVD detail page offer source-provided CVE metadata and source-specific vulnerability assessments. Defenses

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.