This vulnerability affects Oracle MySQL Server and MySQL Cluster in the Server: Clone Plugin component. It impacts MySQL Server versions 8.4.0 through 8.4.10 and 9.7.0 through 9.7.1, as well as MySQL Cluster versions 8.0.0 through 8.0.47, 8.4.0 through 8.4.10, and 9.7.0 through 9.7.1. The vulnerability is difficult to exploit and requires a high privileged attacker with logon access to the infrastructure hosting the MySQL Server or Cluster. Successful exploitation can result in full compromise and takeover of the MySQL Server or Cluster. The CVSS 3.1 vector indicates local attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its July 2026 Critical Patch Update, which includes patches for affected MySQL versions.

A successful attack can lead to complete compromise and takeover of the MySQL Server or MySQL Cluster, impacting confidentiality, integrity, and availability of the database systems. The attacker must have high privileges and logon access to the infrastructure, and the attack complexity is high, making exploitation difficult. There are no known exploits in the wild at this time.

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Users should apply the relevant patches promptly to affected MySQL Server and MySQL Cluster versions. The vendor advisory strongly recommends staying on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory, indicating that an official fix is available.