This vulnerability exists in the Server: X Plugin component of Oracle MySQL Server and MySQL Cluster. It affects MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. The flaw allows an attacker with high privileges and network access through multiple protocols to compromise the server, potentially leading to full takeover. The CVSS 3.1 base score is 7.2, indicating a high severity with impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation status for this specific issue.

Successful exploitation can lead to complete compromise of the MySQL Server or MySQL Cluster, affecting confidentiality, integrity, and availability of the affected systems. The attacker requires high privileges and network access. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance. Oracle strongly recommends applying security patches promptly and staying on actively supported versions. Until explicit patches are confirmed, restrict network access to MySQL services to trusted users with high privileges and monitor for unusual activity related to MySQL Server and Cluster components.