CVE-2026-21998

OVERVIEW: CVE-2026-21998 is a vulnerability in the MySQL Server Optimizer component affecting multiple versions including 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. The flaw allows high-privileged attackers to remotely exploit the system through multiple network protocols. SEVERITY: The vulnerability carries a CVSS 3.1 base score of 4.9 (Medium severity) with a network attack vector and low attack complexity. Successful exploitation requires high privilege credentials but no user interaction. The impact is limited to availability, as attackers can trigger a denial-of-service condition through repeated crashes or system hangs of the MySQL Server, with no confidentiality or integrity impacts. EXPLOITATION STATUS: This vulnerability currently shows minimal exploitation activity and community attention. The EPSS score of 0.00037 indicates very low probability of exploitation in the wild, and the CVE is not listed on the KEV catalog or the Hot List. No active exploit code is publicly confirmed to be circulating, suggesting limited threat in operational environments at this time.