This vulnerability resides in the Shell for VS Code component of Oracle MySQL Shell version 2026.2.0+9.6.1. It permits a low‑privileged attacker who can reach the system over the network to compromise the shell, leading to full takeover of the MySQL Shell instance. The exploit is described as difficult, but when successful it grants an attacker complete control, impacting confidentiality, integrity, and availability. Because the Shell is part of the broader MySQL ecosystem, a compromise could also affect other Oracle products, representing a scope change.

Affected product is Oracle MySQL Shell, specifically the Shell for VS Code component in version 2026.2.0+9.6.1. No additional vendor or product versions are listed.

The CVSS v3.1 base score is 8.5, indicating high severity, and the EPSS score is below 1%, suggesting a low but non‑zero likelihood of exploitation. The vulnerability is not included in CISA KEV. The attack vector is network‑based using multiple protocols; a low‑privileged attacker can gain access and achieve full control of the shell. The high confidentiality, integrity, and availability impact underscore the critical nature of the vulnerability.