This vulnerability affects Oracle MySQL Connectors versions 9.7.0 to 9.7.1, enabling an unauthenticated attacker with network access to exploit the system via multiple protocols. Exploitation requires user interaction from a third party. The impact is unauthorized access to critical or all accessible data via the MySQL Connectors. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact without integrity or availability impact. The vulnerability is associated with CWEs including CWE-601 (URL Redirection), CWE-285 (Improper Authorization), CWE-352 (Cross-Site Request Forgery), and CWE-200 (Information Exposure).

Exploitation can result in unauthorized access to sensitive or critical data accessible through the affected MySQL Connectors. There is no reported impact on data integrity or availability. The attack requires user interaction from a person other than the attacker, which limits exploitation scenarios. No known exploits in the wild have been reported to date.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, no explicit patch or remediation level is stated for MySQL Connectors versions 9.7.0-9.7.1 in the advisory content provided. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance and patch availability.