CVE-2026-21965: 
MySQL vulnerability analysis and mitigation

CVE-2026-21965 is a denial-of-service vulnerability in the Pluggable Auth component of Oracle MySQL Server, affecting versions 9.0.0 through 9.5.0. It was disclosed on January 20, 2026, as part of Oracle's January 2026 Critical Patch Update. The vulnerability allows a high-privileged attacker with network access to cause a partial denial of service against the MySQL Server. It carries a CVSS v3.1 base score of 2.7 (Low severity) (Oracle CPU Jan 2026).

The vulnerability resides in the Server: Pluggable Auth component of MySQL Server, which handles authentication plugin processing. A high-privileged attacker can exploit this flaw over a network using multiple protocols without requiring user interaction, suggesting a flaw in how the Pluggable Auth component handles certain inputs or requests from privileged sessions (CWE classification not explicitly specified by Oracle). The low attack complexity indicates the exploit conditions are straightforward once the attacker has the required high-privilege access. No public technical write-ups or proof-of-concept code have been identified (Oracle CPU Jan 2026).

Successful exploitation results in a partial denial of service, specifically impacting the availability of the MySQL Server. There is no impact to confidentiality or integrity. The scope is limited to the affected MySQL Server instance, with no evidence of lateral movement potential or data exposure risk associated with this vulnerability (Oracle CPU Jan 2026).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.036%, reflecting a very low probability of exploitation in the near term. Exploitation requires high-privilege credentials, further limiting the realistic attacker pool (Oracle CPU Jan 2026).

Oracle has addressed this vulnerability in the January 2026 Critical Patch Update. Users should upgrade MySQL Server from affected versions (9.0.0–9.5.0) to a patched release as provided in the CPU. As a temporary measure, Oracle recommends restricting network access to MySQL Server to only trusted administrators and limiting which high-privileged users can interact with the Pluggable Auth component. Oracle strongly advises against relying on network-blocking workarounds as a long-term solution (Oracle CPU Jan 2026).