CVE-2026-46869 is a medium severity vulnerability in Oracle MySQL Shell's Dump and Load component affecting versions 8.4.0-8.4.9 and 9.0.0-9.7.0. It permits an unauthenticated attacker with network access via multiple protocols to compromise MySQL Shell, contingent on user interaction from a non-attacker. Exploitation can result in unauthorized access to critical or all data accessible through MySQL Shell. The vulnerability has a CVSS 3.1 score of 6.5 with a vector indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes patches for MySQL Shell among other products. Oracle advises customers to apply these patches without delay and provides guidance on temporary risk reduction measures such as blocking network protocols or limiting privileges, acknowledging potential impacts on application functionality.

Successful exploitation of this vulnerability can lead to unauthorized access to critical or all data accessible by MySQL Shell. The confidentiality of data is impacted, but integrity and availability are not affected according to the CVSS vector. The attack requires network access and user interaction from a person other than the attacker. There are no known exploits in the wild at this time.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches promptly to mitigate the risk. Until patches are applied, risk may be reduced by blocking network protocols required by the attack or by removing unnecessary privileges from users, though these measures may affect application functionality. Patch status is confirmed by Oracle's advisory: a fix is available. Refer to the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.