This vulnerability in Oracle MySQL Server and MySQL Cluster versions 9.7.0 to 9.7.1 involves the Server: Optimizer component. It allows a high privileged attacker with network access to cause a hang or repeated crash, resulting in a complete denial of service (DoS). The CVSS 3.1 base score is 4.9, reflecting an availability impact only, with no confidentiality or integrity impact. The vulnerability is easily exploitable given low attack complexity and network access. The Oracle advisory linked does not explicitly state a patch or remediation level for this specific CVE, though it references a large Critical Patch Update containing many fixes. Patch status for this vulnerability is not yet confirmed and should be verified against Oracle's official security advisories.

Successful exploitation results in denial of service by causing the MySQL Server or MySQL Cluster to hang or crash repeatedly. There is no impact on data confidentiality or integrity. The vulnerability requires high privileges and network access but does not require user interaction.

Patch status is not yet confirmed for this vulnerability. Oracle's Critical Patch Update advisory for July 2026 does not explicitly mention a fix for CVE-2026-61128. It is recommended to monitor Oracle's security advisories and apply patches promptly once available. Until a patch is confirmed, restrict high privileged network access to MySQL Server and Cluster instances to trusted administrators only.