Oracle VM VirtualBox CVE-2026-35246

Exploitation requires the attacker to already have a high-privileged account with interactive logon to the host operating system where Oracle VM VirtualBox 7.2.6 executes (CVSS AV:L, PR:H) - this is not remotely reachable and not exploitable by an unauthenticated or low-privileged user. The affected code path is the VirtualBox Core component, and success additionally depends on satisfying a difficult-to-meet condition reflected by AC:H, meaning the attack is not reliable or automatable (SSVC automatable: no). No user interaction is required (UI:N). Key limiting factors: the high pre-existing privilege requirement, local-only access, and high attack complexity substantially narrow the realistic attacker population to insiders or actors who have already compromised a privileged host account; only version 7.2.6 is confirmed affected.

Signals converge on this being a real but lower-priority-for-broad-attack issue. The CVSS 3.1 score of 7.5 is elevated primarily by the scope change (S:C) and total technical impact (C:H/I:H/A:H), but the exploitability metrics are constraining: AV:L requires local logon to the host, AC:H indicates a hard-to-exploit condition (matching Oracle's 'difficult to exploit' language), and PR:H means the attacker must already hold high privileges. EPSS is negligible at 0.01% (2nd percentile), and CISA SSVC rates exploitation as none and automatable as no, while acknowledging total technical impact. These signals are mutually consistent - there is no contradiction between the high impact and the low exploitation probability. The practical picture: a serious impact ceiling (host takeover with cross-boundary reach) gated behind a high privilege and access barrier, so this is a defense-in-depth / patch-in-normal-cycle item rather than an emergency. Note the PR:H requirement somewhat tensions the 'Authentication Bypass' tag - verify with Oracle which trust boundary is actually bypassed, since a pre-existing high-privilege requirement narrows the bypass to a specific in-product boundary rather than initial access.

An attacker who has already obtained high-privileged logon access to a host running Oracle VM VirtualBox 7.2.6 abuses an improper access-control flaw in the Core component to cross the hypervisor trust boundary, taking over VirtualBox and impacting resources beyond it (scope change). Given AV:L/AC:H, the attack is local and technically difficult, requiring specific conditions to be met rather than a simple one-shot trigger. No public exploit identified at time of analysis.