This vulnerability in Oracle MySQL Server and MySQL Cluster affects the replication component and is exploitable by a high-privileged attacker with network access via multiple protocols. Successful exploitation can lead to complete compromise of the MySQL Server or Cluster. The affected versions are MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes patches for this vulnerability. No known exploits in the wild have been reported as of the publication date.

The vulnerability allows a high-privileged attacker with network access to fully compromise the MySQL Server or MySQL Cluster, impacting confidentiality, integrity, and availability of the affected systems. This can result in complete takeover of the database server, potentially leading to unauthorized data access, data manipulation, or service disruption.

Oracle has released patches for this vulnerability in the July 2026 Critical Patch Update. Users should apply the official Oracle patches promptly to remediate this issue. The vendor strongly recommends staying on actively-supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html.