This vulnerability in Oracle MySQL Shell (component: Shell for VS Code) allows a low privileged attacker with network access and high attack complexity to compromise the MySQL Shell, resulting in full takeover. The CVSS 3.1 base score is 8.5, reflecting high impact on confidentiality, integrity, and availability. The vulnerability also has a scope change, meaning successful exploitation could affect additional Oracle products beyond MySQL Shell. The affected version explicitly stated is 2026.2.0+9.6.1. Oracle's June 2026 Critical Security Patch Update addresses this vulnerability among 245 others, but no specific patch link for MySQL Shell is provided. Oracle strongly recommends applying the full Critical Security Patch Update to mitigate the risk.

Successful exploitation can lead to complete compromise of MySQL Shell, impacting confidentiality, integrity, and availability of the affected system. Due to scope change, other Oracle products may also be significantly impacted. The vulnerability requires network access and is difficult to exploit, but the attacker needs only low privileges and no user interaction. The high CVSS score (8.5) reflects the critical nature of the impact.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability along with others. Until patches are applied, risk can be reduced by blocking network protocols required by potential attacks and by removing unnecessary privileges or package access from users. These mitigations may affect application functionality, so they should be tested carefully. No specific standalone patch or temporary fix for MySQL Shell has been confirmed; customers should rely on Oracle's cumulative patch update.