CVE-2026-46870 is a vulnerability in Oracle MySQL Shell (Shell for VS Code) version 2026.2.0+9.6.1 that allows a low privileged attacker with network access via multiple protocols to compromise the MySQL Shell. The vulnerability has a CVSS 3.1 score of 8.5 with high confidentiality, integrity, and availability impacts and a scope change affecting additional products. The vulnerability is difficult to exploit and requires high attack complexity but no user interaction. Oracle has published this vulnerability in its June 2026 Critical Security Patch Update advisory, which includes 245 security patches across multiple Oracle products, including MySQL Shell versions 8.4.0-8.4.9, 9.0.0-9.7.0, and 2026.2.0+9.6.1. The advisory strongly recommends applying the patches as soon as possible. Until patches are applied, risk reduction may be possible by blocking network protocols required for exploitation or removing unnecessary privileges from users, although these mitigations may impact functionality.

Successful exploitation of CVE-2026-46870 can result in full takeover of the MySQL Shell, impacting confidentiality, integrity, and availability of the affected system. The vulnerability also has scope change implications, meaning that exploitation may affect additional Oracle products beyond MySQL Shell. The attack requires network access and low privileges but has high attack complexity. There are no known exploits in the wild at this time.

Oracle has included this vulnerability in its June 2026 Critical Security Patch Update advisory but has not explicitly confirmed patch availability for version 2026.2.0+9.6.1. Customers are strongly advised to apply the June 2026 Critical Security Patch Update promptly to address this and other vulnerabilities. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users who do not require them. These mitigations may impact application functionality and should be tested accordingly. Patch status is not yet confirmed for this specific version—check the Oracle advisory for current remediation guidance.