This vulnerability affects Oracle MySQL Connectors, versions 9.7.0 to 9.7.1, allowing unauthenticated remote attackers to compromise the connectors via multiple network protocols. The attack requires user interaction from a third party. The impact is unauthorized access to critical or all data accessible through the MySQL Connectors. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact with no integrity or availability impact. Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory, which addresses multiple vulnerabilities across Oracle products, including MySQL Connectors. However, the vendor advisory does not explicitly confirm the availability of a patch for this specific vulnerability at this time.

An unauthenticated attacker with network access can exploit this vulnerability to gain unauthorized access to critical data or complete data accessible via MySQL Connectors. The attack requires user interaction from a person other than the attacker, which may limit exploitation scenarios. The confidentiality of data is impacted, but integrity and availability are not affected according to the CVSS vector.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, limit exposure by restricting network access to MySQL Connectors and educating users to avoid interacting with suspicious content that could trigger exploitation.