This vulnerability exists in the Group Replication Plugin component of Oracle MySQL Server and MySQL Cluster. It affects multiple versions including MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. An unauthenticated attacker who has logon access to the underlying infrastructure can exploit this flaw to compromise the MySQL Server or Cluster, potentially leading to complete takeover. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates local attack vector with low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability among many others but does not explicitly state patch availability or remediation details for these affected versions.

Successful exploitation allows an unauthenticated attacker with logon access to the infrastructure hosting MySQL Server or MySQL Cluster to fully compromise the database server or cluster. This results in complete loss of confidentiality, integrity, and availability of the affected MySQL instances. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.4.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses this and many other vulnerabilities. However, the advisory does not explicitly confirm patch availability or provide specific remediation instructions for the affected MySQL versions. Users should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant patches promptly. Until official patches or mitigations are confirmed, restrict logon access to the infrastructure hosting MySQL Server and MySQL Cluster to trusted personnel only to reduce risk.