This vulnerability (CVE-2026-47012) affects the Oracle MySQL Server and MySQL Cluster products, specifically the Server Optimizer component. It is exploitable by a high privileged attacker with network access through multiple protocols, potentially causing the MySQL Server or Cluster to hang or crash repeatedly, leading to a complete denial of service. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. Affected versions include MySQL Server 8.4.0 to 8.4.10 and 9.7.0 to 9.7.1, and MySQL Cluster 8.0.0 to 8.0.47, 8.4.0 to 8.4.10, and 9.7.0 to 9.7.1. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state patch availability or remediation level for these specific versions in the provided content.

Successful exploitation allows a high privileged attacker with network access to cause a hang or repeated crash of MySQL Server or MySQL Cluster, resulting in a denial of service. There is no impact on confidentiality or integrity. The attack complexity is high and requires high privileges, limiting the likelihood of exploitation. The overall impact is medium severity due to availability disruption.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the provided advisory content does not explicitly confirm the availability of a patch or official fix for the affected versions. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply updates promptly if patches are released. Until a patch is confirmed, monitor Oracle's official channels for remediation guidance. No vendor statement indicates that no action is required or that the issue is already mitigated.