EUVD-2026-24418Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Network vector confirmed by multi-protocol access description; PR:H and AC:H reflect high-privilege and difficult exploitation requirements; S:C for adjacent-system data exposure; no integrity or availability impact described.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Shell. While the vulnerability is in MySQL Shell, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Shell accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).
AnalysisAI
Confidentiality breach in Oracle MySQL Shell's Core Client component across three major version branches (8.0.x, 8.4.x, and 9.0.x) permits a high-privileged, network-connected attacker to gain unauthorized access to critical or complete MySQL Shell-accessible data, with a CVSS scope change (S:C) indicating potential impact on adjacent systems. No public exploit code has been identified at time of analysis, and an EPSS score of 0.03% at the 8th percentile reflects near-zero observed exploitation probability. SSVC classifies exploitation status as none and technical impact as only partial, underscoring that despite the scope-change flag and high confidentiality impact, real-world urgency is low given the steep access prerequisites.
Technical ContextAI
MySQL Shell is Oracle's advanced command-line client and scripting environment for MySQL, supporting JavaScript, Python, and SQL execution modes and used widely in enterprise database automation workflows. The vulnerability resides in the Core Client component, the shared engine underpinning all three execution modes, which explains the reference to 'multiple protocols' in the description. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause class as improper information filtering or access control - the Shell fails to enforce boundaries on data it surfaces or transmits to the attacker-controlled session. The CVSS scope change (S:C) is significant: it indicates the flaw enables access to resources or data outside the MySQL Shell process boundary itself, potentially reaching underlying MySQL server data, connected schemas, or other systems the Shell session is authorized to access. The CPE identifier cpe:2.3:a:oracle_corporation:mysql_shell:*:*:*:*:*:*:*:* spans all affected branches without further platform restriction.
RemediationAI
The primary remediation is to upgrade MySQL Shell to a patched version per the Oracle Critical Patch Update (April 2026) advisory at https://www.oracle.com/security-alerts/cpuapr2026.html. Exact fixed version numbers are not independently confirmed from available data - consult the Oracle CPU directly to obtain the specific upgrade target for each branch (8.0.x, 8.4.x, 9.0.x). While patching is pending, apply compensating controls: restrict network access to MySQL Shell endpoints to only explicitly authorized administrator hosts using firewall rules or network segmentation, reducing the network-accessible attack surface. Audit and enforce least-privilege on MySQL Shell accounts so that high-privileged credentials are held only by named, accountable individuals - this directly raises the cost of exploitation. Review which downstream systems and schemas MySQL Shell sessions can reach, and limit cross-system connectivity where not operationally required to reduce scope-change exposure. Given the 'multiple protocols' reference, consider disabling unused Shell execution modes or protocol endpoints if the environment only uses a subset. Note that these controls reduce exposure but do not eliminate the vulnerability; patching remains the definitive fix.
More in Mysql Shell
View allPrivilege escalation and full takeover of Oracle MySQL Shell's VS Code extension affects version 2026.2.0+9.6.1, allowin
Takeover of Oracle MySQL Shell is possible against the Shell for VS Code component in version 2026.2.0+9.6.1, where a lo
Unauthorized data disclosure in Oracle MySQL Shell's VS Code extension component (version 2026.2.0+9.6.1) allows a low-p
Unauthorized access to critical data is achievable in Oracle MySQL Shell's Dump and Load component, affecting versions 8
Local denial-of-service in MySQL Shell's Core Client component allows a low-privileged OS user, with required interactio
Denial-of-service in Oracle MySQL Shell's Core Client component allows a low-privileged local attacker, with required hu
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: General/Core Client). Rated low severity (CV
Same weakness CWE-200 – Information Exposure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today