This vulnerability in Oracle MySQL Connectors (Connector/J component) affects versions 9.7.0 through 9.7.1 and is difficult to exploit but allows a low privileged attacker with network access to compromise the connectors. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, unauthorized access to all data accessible by the connectors, and partial denial of service conditions. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact. The vulnerability is catalogued under CWE-306 (Missing Authentication for Critical Function). Oracle's July 2026 Critical Patch Update advisory references affected MySQL Connectors versions 9.7.0-9.7.1 but does not explicitly state patch availability or remediation for this specific vulnerability.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data accessible via MySQL Connectors, unauthorized access to all data accessible by these connectors, and the ability to cause a partial denial of service. The vulnerability impacts confidentiality, integrity, and availability of the affected systems as indicated by the CVSS score of 7.1.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm patch availability or remediation status for MySQL Connectors 9.7.0-9.7.1. Therefore, patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions. Until an official patch is confirmed, monitor Oracle advisories for updates and consider limiting network exposure of MySQL Connectors to trusted sources to reduce risk.