This vulnerability (CVE-2026-61096) affects Oracle MySQL Server and MySQL Cluster products, specifically the Server: Pluggable Auth component. It allows an unauthenticated attacker who has logon access to the infrastructure where MySQL executes to compromise the server by performing unauthorized update, insert, or delete operations on accessible data. The vulnerability is rated with a CVSS 3.1 base score of 2.9, reflecting low severity and limited impact on integrity only. Affected versions include MySQL Server 8.4.0-8.4.10, 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state whether a patch is available or if the issue is mitigated. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized modification of some data accessible by MySQL Server or MySQL Cluster, specifically allowing update, insert, or delete operations. There is no impact on confidentiality or availability. The vulnerability requires attacker logon access to the infrastructure and is difficult to exploit, limiting its risk. The overall severity is low based on the CVSS score and impact vector.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Since no explicit patch or workaround is stated for this vulnerability in the advisory, monitor Oracle's updates for any forthcoming fixes. No vendor advisory indicates that no action is required or that the vulnerability is already mitigated.