What is the CVSS score of CVE-2026-35242?

CVE-2026-35242 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Oracle VirtualBox are affected by CVE-2026-35242?

Oracle VM VirtualBox 7.2.6 contains a critical flaw that enables high-privileged local users to completely compromise affected systems, potentially reaching connected infrastructure and applications.

How to fix or mitigate CVE-2026-35242?

Given the lack of public exploit activity and high exploitation difficulty, within 24 hours identify and inventory all systems running VirtualBox 7.2.6, assess their criticality, and document connected systems. Within 7 days, restrict local administrative and logon access to VirtualBox host systems to only essential personnel, implement multi-factor authentication for high-privilege accounts, and document transition planning to patched versions when released by Oracle. Within 30 days, monitor vendor advisories for patch availability, conduct security assessments of systems that had permitted local administrative access, and complete upgrade testing to newer VirtualBox versions that address this vulnerability.

Oracle VirtualBox CVE-2026-35242

EUVD-2026-24449 HIGH

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-x9m8-mrxv-cvc8

Authentication Bypass Oracle Oracle Vm Virtualbox

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Local high-privileged host access with difficult, condition-dependent exploitation (AV:L/AC:H/PR:H); scope change to host with total impact confirms S:C and C:H/I:H/A:H.

3.1 AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:02 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24449

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can log on to the host where VirtualBox runs, per Oracle's April 2026 Critical Patch Update. Because the flaw carries a scope change (S:C), a successful attack breaks out of VirtualBox and can significantly impact additional products on the host, yielding total loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with the high exploitation difficulty (AC:H) and the local, high-privilege prerequisite.

Technical ContextAI

Oracle VM VirtualBox is a type-2 hypervisor that runs guest virtual machines on top of a host OS; the affected 'Core' component covers the central virtualization engine and the host-guest boundary. The weakness is classified as CWE-284 (Improper Access Control), and the intelligence tag labels it an 'Authentication Bypass', meaning an access-control mechanism enforcing the VM/host security boundary can be subverted. The CVSS scope change (S:C) is the defining characteristic: the vulnerable component (VirtualBox) and the impacted component differ, which for a hypervisor typically reflects a component-to-host or guest-to-host boundary crossing where the exploited process affects resources it should not control. The affected package is identified by CPE cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:*.

RemediationAI

Apply the fix delivered in Oracle's April 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuapr2026.html); this is the authoritative source for the exact patched VirtualBox release, which is not independently enumerated as a discrete version number in the available data beyond the affected 7.2.6 baseline. Until the CPU patch is deployed, reduce exposure by tightly restricting who holds high-privileged interactive logon on VirtualBox hosts, since exploitation requires PR:H local access - enforce least privilege on host administrator/root accounts, remove unnecessary local operator access, and monitor for anomalous privileged activity, accepting the trade-off of added operational friction for legitimate admins. On multi-tenant or shared virtualization hosts, isolate untrusted or high-risk VMs onto separate hosts to contain the scope-change (host takeover) impact. Because this is host-local and high-privilege, network-layer controls provide little mitigation, so prioritize the Oracle patch.