The vulnerability resides in the Group Replication Plugin of MySQL Server, as identified by Oracle. It permits any unauthorized actor who can communicate on the same physical network segment as the database to force the server or cluster to hang or crash, thereby causing a denial of service. In addition, the same local access lets the attacker insert, update, or delete data that normally would be protected, which results in a breach of data integrity. The attack requires no credentials because the adversary only needs to be on the same network segment where the MySQL instance is running, making the exploit straightforward once physical LAN access is granted.

Oracle's MySQL Server versions 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1 are vulnerable, as are MySQL Cluster versions 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1. The affected component is the Server: Group Replication Plugin for both products, covering all installations of the specified MySQL Server and Cluster versions across all database configurations.

The CVSS base score of 7.1 indicates a moderate impact focusing on availability and integrity, with the exploit vector classified as adjacent (AV:A). The EPSS score is < 1%, indicating a low likelihood of exploitation, and the vulnerability is not registered in the CISA KEV catalog, implying no known widespread exploitation yet. Nonetheless, because the requirement is physical or local network proximity, environments that expose the database to untrusted local traffic or lack robust segmentation face a significant risk. Attacks can be performed quickly and repeatedly, potentially crippling services and corrupting data until mitigated.