CVE-2026-34318
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Vulnerability in MySQL Shell (component: Shell: Core Client) affecting versions 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. A difficult-to-exploit flaw allows a high-privileged attacker with network access to gain unauthorized access to critical data or all MySQL Shell accessible data, with possible impact on additional products (scope change).
Risk Assessment
Despite high requirements (high privileges, difficult exploitation), successful attacks can lead to critical data exposure and impact on related systems. Organizations using MySQL Shell should assess network exposure and account privileges.
Recommendation
Update MySQL Shell to a version containing the fix (outside 8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0) and restrict network access and privileges to the necessary minimum.
Other vulnerabilities in MySQL Shell
See all- CVE-2026-34319Medium
An easily exploitable vulnerability exists in Oracle MySQL Shell (Shell: Core Client component) in versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. A low-privileged attacker with logon to the infrastructure where MySQL Shell executes can cause a hang or frequently repeatable crash (complete DoS), requiring user interaction.
- CVE-2026-34317Medium
An easily exploitable vulnerability exists in Oracle MySQL Shell (Shell: Core Client component) in versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. A low-privileged attacker with logon to the infrastructure where MySQL Shell executes can cause a hang or frequently repeatable crash (complete DoS), requiring user interaction.
- CVE-2022-21535Low
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: General/Core Client) affects versions 8.0.28 and prior. It allows an unauthenticated attacker with access to the infrastructure where MySQL Shell runs to compromise it, requiring interaction from a person other than the attacker.
Original NVD description (English source)
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Shell. While the vulnerability is in MySQL Shell, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Shell accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS