The Oracle MySQL Server and MySQL Cluster software contain a vulnerability in the Connection Handling component that lets an unauthenticated attacker with network access compromise the database. By exploiting this flaw, an attacker can connect without providing valid credentials and then perform update, insert, or delete operations on data that should otherwise be protected. The flaw is reflected in CVSS as an integrity impact, with a base score of 5.3, indicating a medium risk to data integrity if exploited.

The affected products are Oracle MySQL Server versions 26.7.0 through 26.7.1 and Oracle MySQL Cluster versions 26.7.0 through 26.7.1. These releases enable remote connections over multiple protocols and lack proper authentication in the connection phase, making them susceptible to the described attack.

No known exploitation has been reported, as the vulnerability is not listed in the CISA KEV catalog and the EPSS score is < 1%. The CVSS score of 5.3 indicates a moderate severity; however, because the attack requires no user interaction and can be carried out remotely via network protocols, the potential impact remains significant for environments that expose these services to untrusted networks. Administrators should evaluate whether their MySQL instances are reachable from external networks and consider the likelihood of an opportunistic attacker exploiting this flaw.