CVE-2026-46871 affects Oracle MySQL Shell (Shell for VS Code) version 2026.2.0+9.6.1. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via multiple protocols to compromise the MySQL Shell, resulting in unauthorized access to critical or all data accessible through the shell. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. The vulnerability is included in Oracle's June 2026 Critical Security Patch Update, which contains 245 security patches across many Oracle products including MySQL Shell. Oracle strongly advises customers to apply these patches promptly. Until patched, risk can be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users.

Successful exploitation of this vulnerability can lead to unauthorized access to critical or all data accessible via MySQL Shell. The confidentiality of data is severely impacted, but there is no direct impact on data integrity or availability. The vulnerability requires network access and low privileges but no user interaction, making it moderately easy to exploit in environments where the attacker has network access.

Oracle has included this vulnerability in the June 2026 Critical Security Patch Update and strongly recommends applying these patches without delay. Until patches are applied, risk can be mitigated by blocking network protocols required for exploitation and by removing privileges or access to packages from users who do not need them. These mitigations may impact application functionality, so they should be applied carefully. Patch status is not explicitly confirmed for the exact affected version; therefore, check Oracle's June 2026 Critical Security Patch Update advisory for the latest remediation guidance.