This vulnerability (CVE-2026-61081) affects Oracle MySQL Server and MySQL Cluster in the Performance Schema component. It is exploitable by a high privileged attacker with network access via multiple protocols, allowing unauthorized read access to a subset of accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and limited confidentiality impact without integrity or availability impact. The affected versions explicitly stated are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not provide explicit patch or remediation details for it. No known exploits in the wild have been reported.

Successful exploitation allows a high privileged attacker with network access to read unauthorized data subsets from MySQL Server or MySQL Cluster. The impact is limited to confidentiality with no effect on integrity or availability. The CVSS score of 2.7 reflects this limited confidentiality impact. There are no reports of active exploitation in the wild.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm patch availability or remediation status for CVE-2026-61081. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant Critical Patch Updates promptly and remaining on actively supported versions to mitigate risks from known vulnerabilities.