The vulnerability allows an unauthenticated attacker with network access to execute an attack that can cause MySQL Router to hang or crash, resulting in a complete denial of service. The CVSS vector indicates the weakness is exploitable over the network, requires no authentication, and has a high availability impact without affecting confidentiality or integrity. This means an attacker can interrupt the operation of the router without compromising data or gaining privileged access. The weakness is classified as CWE-284 (Improper Authentication), indicating that the router fails to properly enforce authentication before allowing the operations that lead to the fault.

Oracle MySQL Router 26.7.0 is affected. No other versions or products are listed, so only installations of this specific version are vulnerable.

The vulnerability has a CVSS Base Score of 7.5, indicating a high severity. The EPSS score is < 1%, indicating a very low but nonzero probability of exploitation in the wild. It is not yet listed in the CISA KEV catalog. The attack vector is network‑based; the attacker does not need authentication or a special protocol. If the router is exposed to the internet or untrusted networks, the risk of a denial‑of‑service attack is significant.