CVE-2026-46850 is a critical vulnerability in the MySQL Shell component of Oracle MySQL, affecting version 2026.2.0+9.6.1. The flaw allows a low privileged attacker with network access via HTTP to compromise MySQL Shell, with a scope change that may affect additional Oracle products. The vulnerability has a CVSS 3.1 score of 9.9, reflecting critical impacts on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple Oracle product families. The advisory emphasizes the importance of applying these patches without delay and suggests possible risk reduction by blocking certain network protocols and removing unnecessary privileges until patches are applied.

Successful exploitation of this vulnerability can lead to complete takeover of MySQL Shell, resulting in full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability's scope change means that additional Oracle products relying on MySQL Shell may also be impacted. The CVSS 3.1 score of 9.9 underscores the critical severity of this issue.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers are strongly advised to apply these security patches as soon as possible. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users who do not require them. These mitigations may impact application functionality, so they should be tested carefully. Patch status is confirmed as available via Oracle's Critical Security Patch Update.