CVE-2026-34318

CVE-2026-34318 is a confidentiality vulnerability in Oracle MySQL Shell affecting versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. While the flaw resides in MySQL Shell, successful exploitation could impact additional downstream products due to a scope change. The vulnerability allows attackers to gain unauthorized access to critical data or complete access to all data accessible through MySQL Shell. The vulnerability has a CVSS 3.1 base score of 5.8 (Medium severity) and requires a high-privileged attacker with network access across multiple protocols to exploit. The attack complexity is rated as high, meaning the exploitation conditions are difficult to achieve. The primary impact is high confidentiality loss, with no integrity or availability impacts; however, the cross-boundary scope change elevates the overall risk profile. There is currently no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA KEV catalog and is marked as inactive on threat intelligence hotlists. The extremely low EPSS score of 0.0003 and FAUCET risk score of 33/100 indicate minimal community attention and real-world exploitation likelihood at this time. Organizations should prioritize patching based on their deployment of affected MySQL Shell versions, though the low exploitation risk suggests this is not an immediate critical threat.