The flaw is located in the Server: Components Services of Oracle MySQL and allows a local attacker who already has logon credentials with high privileges to compromise the MySQL Server or Cluster. This results in full control over the database, giving the attacker the ability to read, modify, and delete any data and to disrupt service availability. Because the CVSS vector indicates local access, high privilege, and no user interaction, exploitation requires only a login to the host and can be performed by any user who can log into the infrastructure running MySQL.

Affected are Oracle MySQL Server versions 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1. The same ranges apply to Oracle MySQL Cluster, which includes versions 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1.

The CVSS 3.1 score of 6.7 reflects a moderate to high severity vulnerability that impacts confidentiality, integrity, and availability. With a local attack vector, an attacker who can log onto the host where MySQL executes and possesses high‑privilege credentials can exploit this flaw without additional user interaction. The EPSS score is < 1%, indicating a very low but non‑zero likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog, but the risk remains significant for environments where untrusted users can access the database hosts.