Oracle VM VirtualBox CVE-2026-101598

Requires a pre-existing low-privileged interactive logon (PR:L) on the host system where Oracle VM VirtualBox 7.2.20 executes; the attack vector is local (AV:L), so remote exploitation is not possible without first obtaining such access. Exploitation targets the Core component and needs no user interaction (UI:N) and low complexity (AC:L). Limiting factors: only version 7.2.20 is listed as affected, the attacker must already be authenticated on the host, and there is no network-facing exposure - which substantially narrows realistic exploitation to multi-user, shared, or untrusted-guest/local scenarios rather than internet-wide attack.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a locally exploitable flaw: the attacker must already have a low-privileged logon to the host where VirtualBox runs, but exploitation is low-complexity, requires no user interaction, and yields full confidentiality, integrity, and availability impact (host-level takeover of VirtualBox). All signals are consistent - there is no network vector, so this is a privilege-escalation / guest-or-local-user-to-host class issue rather than a remotely wormable one. EPSS score, CISA KEV status, and public POC availability are all ABSENT from the input, so there is no evidence of active or likely-imminent exploitation; this should be treated as a vendor-disclosed (Oracle CPU) local escalation bug, not an emergency internet-facing threat. Net assessment: a genuinely serious local privilege/isolation issue that matters most in multi-tenant, shared-workstation, or untrusted-guest scenarios, but its real-world urgency is tempered by the local attack vector and the required pre-existing authenticated access. The 'Information Disclosure' tag understates the impact, which the description explicitly states as full takeover with C:H/I:H/A:H.

A low-privileged user who already has a login on a host running Oracle VM VirtualBox 7.2.20 - or an attacker who has compromised an unprivileged account - exploits a flaw in the Core component to break isolation and fully compromise VirtualBox, resulting in host-level takeover. No user interaction is needed and attack complexity is low. No public exploit code is identified at time of analysis, so this currently requires an attacker to develop their own exploit.