This vulnerability exists in the core client component of Oracle MySQL Shell and affects multiple supported versions. It requires a high privileged attacker with network access to exploit, and it can be exploited via multiple protocols. The vulnerability can lead to unauthorized disclosure of sensitive data accessible through MySQL Shell and may affect other Oracle products due to scope change. The CVSS vector indicates a network attack vector with high attack complexity and privileges required, no user interaction, and a confidentiality impact with no integrity or availability impact. Oracle has acknowledged this vulnerability in their April 2026 Critical Patch Update and has released patches for the affected versions.

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible through MySQL Shell. The vulnerability affects confidentiality but does not impact integrity or availability. The scope change means that other Oracle products that interact with MySQL Shell may also be impacted. There are no known exploits in the wild at this time.

Oracle has released patches for this vulnerability as part of the April 2026 Critical Patch Update. Users of affected MySQL Shell versions (8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0) are strongly advised to apply the relevant patches promptly. No additional mitigation steps are indicated by Oracle beyond applying the official patches. Patch status is confirmed by the vendor advisory.