Oracle VM VirtualBox CVE-2026-35230

Exploitation requires local logon to the infrastructure where Oracle VM VirtualBox 7.2.6 executes (AV:L) and pre-existing high privileges on that host (PR:H) - this is not a remote or unauthenticated vector. Attack complexity is high (AC:H), meaning success depends on conditions outside the attacker's direct control (timing, race, or specific host/guest state), and no user interaction is needed (UI:N). Limiting factors: only the Core component of the specific supported version 7.2.6 is named affected, the attacker must already be a high-privileged local principal, and the difficulty rating indicates exploitation is not reliably repeatable. Despite the 'Authentication Bypass' tag, the CVSS vector confirms authenticated, high-privilege access is a prerequisite.

The signals are consistent and point to a real but hard-to-abuse issue rather than a mass-exploitation threat. The CVSS vector (AV:L/AC:H/PR:H/UI:N) requires local logon, high complexity, and high privileges, so the barrier to entry is substantial; the 7.5 score is driven largely by total C/I/A impact plus the scope change to the host. This aligns with CISA SSVC: Exploitation 'none', Automatable 'no', Technical Impact 'total' - high damage if achieved, but no evidence of exploitation and not automatable. EPSS is 0.01% (2nd percentile) and the CVE is not in CISA KEV, reinforcing low near-term exploitation likelihood. Note the 'Authentication Bypass' tag conflicts with the PR:H vector, which requires the attacker to already hold high privileges; treat the tag as loose categorization, not confirmation of a pre-auth bypass, and verify against the Oracle advisory.

A local attacker who already holds high privileges on a host running VirtualBox 7.2.6 (for example a privileged user of a shared virtualization or CI host, or an attacker who has escalated within a guest/host) leverages the Core access-control flaw to break the guest/host boundary and take over the VirtualBox instance and potentially the host. The high attack complexity (AC:H) means the attacker must satisfy specific timing or environmental conditions, and no public proof-of-concept is currently available.