This vulnerability affects Oracle MySQL Server and MySQL Cluster versions 9.7.0 to 9.7.1 in the Server: Configurator component. It requires an attacker with low privileges and logon access to the infrastructure where MySQL runs. Additionally, successful exploitation depends on human interaction from a third party. The vulnerability can result in complete compromise of the MySQL Server or Cluster. The CVSS vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects that the attack vector is local, with high attack complexity, requiring low privileges and user interaction, and impacts confidentiality, integrity, and availability at a high level. No known exploits are reported in the wild. Oracle’s July 2026 Critical Patch Update advisory lists this vulnerability among many others but does not explicitly confirm availability of a patch for these specific versions. Users are strongly advised to consult the Oracle advisory for patch availability and apply updates promptly.

If successfully exploited, this vulnerability can lead to full takeover of the MySQL Server or MySQL Cluster, impacting confidentiality, integrity, and availability of the database system. However, exploitation is difficult, requiring local access with low privileges and human interaction from a third party. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying available security patches without delay and remaining on actively supported versions. Until a patch is confirmed and applied, limit local access to MySQL infrastructure and educate users to avoid unintended interactions that could facilitate exploitation.