This vulnerability in Oracle MySQL Shell (component: Shell for VS Code) affects version 2026.2.0+9.6.1 and permits a low privileged attacker with network access to exploit the system via multiple protocols. The attack can result in unauthorized access to critical or all data accessible through MySQL Shell. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 patches and strongly recommends applying patches promptly. Interim mitigations include blocking required network protocols and removing unnecessary privileges from users to reduce attack risk.

Successful exploitation allows unauthorized access to critical or all data accessible via MySQL Shell, compromising confidentiality. There is no impact on data integrity or availability. The vulnerability is exploitable remotely over the network with low complexity and requires low privileges, increasing the risk of exposure if unpatched.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update promptly to remediate this vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users. Oracle does not provide a specific patch link for this vulnerability alone but includes it in the broader Critical Security Patch Update. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.