CVE-2026-46850 is an easily exploitable vulnerability in Oracle MySQL Shell version 2026.2.0+9.6.1, specifically in the Shell for VS Code component. It permits a low privileged attacker with network access over HTTP to compromise the MySQL Shell, potentially resulting in complete takeover. The vulnerability has a CVSS 3.1 score of 9.9 with network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impacts on confidentiality, integrity, and availability. While the vulnerability is localized to MySQL Shell, successful exploitation may impact other Oracle products. Oracle’s June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 others. Oracle strongly recommends applying these patches immediately to mitigate the risk. Workarounds include blocking network protocols required by the attack or removing unnecessary privileges from users, though these may disrupt normal operations.

Successful exploitation of CVE-2026-46850 allows an attacker with low privileges and network access via HTTP to fully compromise MySQL Shell, leading to complete takeover. This impacts confidentiality, integrity, and availability of the affected product. The vulnerability’s scope change means that additional Oracle products may also be affected indirectly. The critical CVSS score of 9.9 reflects the severity and ease of exploitation.

Oracle has released a Critical Security Patch Update in June 2026 that addresses CVE-2026-46850 along with many other vulnerabilities. Customers are strongly advised to apply these security patches without delay to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required by the attack or by removing unnecessary privileges from users, though these mitigations may impact application functionality. Oracle’s advisory does not indicate that the vulnerability is already mitigated or that no action is required; therefore, patching is the primary recommended remediation.