MySQL Shell EUVD-2026-37362

Exploitation requires that a human user - other than the attacker - actively initiates a dump or load operation within MySQL Shell (UI:R). The attacker must have network-level reachability to the victim's MySQL Shell session across at least one supported protocol (the advisory states 'multiple protocols', potentially including the MySQL wire protocol and object storage APIs). No authentication credentials on the attacker's part are required (PR:N). The vulnerability is specific to the Dump and Load component, so only MySQL Shell invocations that use dump/load utilities are exploitable - passive MySQL Shell sessions or scripting use-cases not involving this subsystem are not affected. Exploitation is limited to data exfiltration (confidentiality only); no write or denial-of-service impact is possible through this vulnerability. The requirement for user interaction materially reduces the risk of fully automated, opportunistic exploitation.

The CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a realistic mid-tier threat. The high confidentiality impact (C:H) and low attack complexity (AC:L) are significant: an attacker with network positioning and the ability to induce a victim to perform a dump or load operation can exfiltrate the entirety of MySQL Shell-accessible data. However, UI:R is a genuine friction point - exploitation is not fully automated and requires a human to trigger the vulnerable operation. No EPSS score is available in the provided data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not in the CISA KEV catalog and no POC code has been identified, making this a medium-priority item for most organizations. The 'multiple protocols' note in Oracle's advisory suggests the attack surface is broader than HTTP alone, potentially including MySQL protocol connections or S3-compatible object storage integrations used by the Dump and Load utilities. Organizations running automated dump/load pipelines - especially those pointing at external or semi-trusted endpoints - face higher practical risk than those using the tool interactively in controlled environments.

An attacker operates a malicious MySQL server or a rogue S3-compatible object storage endpoint. They social-engineer or otherwise induce a database administrator to run a MySQL Shell load operation (e.g., util.loadDump()) pointed at the attacker's infrastructure. During the load process, the shell's authentication validation fails, allowing the attacker's server to read back or intercept sensitive schema and row data from the victim's MySQL environment. No exploit code is publicly available, but the low attack complexity rating indicates the technique is straightforward once victim interaction is obtained.