This vulnerability in Oracle MySQL Server and MySQL Cluster affects the Server: Clone Plugin component in specified versions. It allows a high privileged attacker with network access via multiple protocols to compromise the server, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, required high privileges, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. The affected versions are MySQL Server 8.4.0-8.4.10, 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among 1449 patches and strongly recommends applying patches without delay. Patch availability is documented in the advisory, but no explicit patch links were provided in the input data.

Successful exploitation can lead to full compromise of the MySQL Server or MySQL Cluster, impacting confidentiality, integrity, and availability of the affected systems. The attacker must have high privileges and network access via multiple protocols. The vulnerability is difficult to exploit but can result in server takeover if exploited.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the security patches promptly to affected MySQL Server and MySQL Cluster versions. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed by the vendor advisory; therefore, applying the official Oracle patches is the recommended remediation.