CVE-2026-46869 is a vulnerability in the MySQL Shell component of Oracle MySQL, affecting versions 8.4.0-8.4.9 and 9.0.0-9.7.0. It allows an unauthenticated attacker with network access via multiple protocols to compromise MySQL Shell, contingent on user interaction from a third party. The vulnerability impacts confidentiality by potentially granting unauthorized access to critical or all data accessible through MySQL Shell. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, scoring 6.5. Oracle’s June 2026 Critical Security Patch Update addresses this vulnerability among 245 others across multiple products, including MySQL Shell. The advisory does not specify a separate patch for this vulnerability but strongly urges customers to apply the Critical Security Patch Update without delay. Mitigation may include blocking network protocols used in attacks or restricting privileges, though these may affect application functionality.

Successful exploitation of this vulnerability can result in unauthorized access to critical or all data accessible by MySQL Shell. The attack requires network access and user interaction from a person other than the attacker. The confidentiality of data is impacted (high confidentiality impact), but integrity and availability are not affected. There are no known exploits in the wild at this time.

Oracle recommends applying the June 2026 Critical Security Patch Update promptly, which includes security patches addressing this vulnerability. Until patches are applied, risk may be mitigated by blocking network protocols required by an attack or by removing unnecessary privileges from users to reduce attack surface. These mitigations may impact application functionality. Oracle strongly advises customers to remain on actively supported versions and apply security patches without delay.