This vulnerability in Oracle MySQL Shell allows an attacker who only has low privileges and network access via HTTP to fully compromise the shell, resulting in loss of confidentiality, integrity, and availability for the affected instance. The flaw effectively permits attackers to gain control over MySQL Shell and could potentially extend their influence to other components, as the vulnerability’s scope is marked changeable.

Products affected include Oracle Corporation’s MySQL Shell, specifically version 2026.2.0+9.6.1. The issue resides in the Shell for VS Code component and is reachable over HTTP from an external network. No other products are listed as directly impacted, but the scope change implies additional systems could be affected if the shell is integrated elsewhere.

The vulnerability carries a CVSS 3.1 base score of 9.9, indicating critical severity, and an EPSS score of less than 1 %, suggesting a very low but non-zero probability of exploitation in the broader threat landscape. The lack of a KEV listing does not diminish the urgency; the attack requires only network access to HTTP and does not mandate elevated privileges. The likely attack vector is a network-based request over HTTP that exploits improper access control within the shell, granting the attacker full takeover capability.