The vulnerability exists in Oracle MySQL Connector/J 26.7.0. An unauthenticated attacker can manipulate the connector through network protocols, but the attacker must rely on a separate individual to trigger the action. If successful, the attacker can update, insert, or delete data that the connector handles, causing integrity loss. The weakness is an improper access control that permits unauthorized data changes without proper authorization.

Oracle Corporation MySQL Connector/J 26.7.0 is the affected system. The product is the Java JDBC driver for MySQL, and only the 26.7.0 release is reported vulnerable.

The CVSS base score of 4.3 indicates a moderate impact focused on integrity. Attackers must be unauthenticated, have network access, and rely on an additional human interaction step to trigger the vulnerable path through one of several supported protocols. Without that human assistance, the vulnerability cannot be fully leveraged. Because no EPSS score is available and the issue is not listed in the CISA KEV catalog, there is presently no evidence of widespread exploitation, yet the potential for unintended data modification remains if an attacker can persuade a user to perform the required action.