What is the CVSS score of CVE-2026-35246?

CVE-2026-35246 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Oracle VM VirtualBox are affected by CVE-2026-35246?

Oracle VM VirtualBox 7.2.6 contains a privilege escalation vulnerability (CVE-2026-35246, CVSS 7.5) that allows high-privileged local users to compromise the hypervisor with full confidentiality,…

How to fix or mitigate CVE-2026-35246?

Within 24 hours, conduct a complete inventory of systems running VirtualBox 7.2.6 and immediately restrict local administrative access to only essential, pre-approved personnel with multi-factor authentication where possible; disable or remove all unnecessary administrative accounts. Within 7 days, enable comprehensive audit logging on all VirtualBox hosts to capture administrative activities, configure real-time alerting for privilege escalation attempts, and implement network segmentation to isolate hypervisor management interfaces from untrusted networks. Within 30 days, establish formal monitoring of Oracle's security advisories to track patch availability, complete a comprehensive access review of all VirtualBox administrators, and evaluate whether business-critical workloads can be migrated to alternative virtualization platforms as a longer-term risk mitigation strategy.

Oracle VM VirtualBox CVE-2026-35246

EUVD-2026-24455 HIGH

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-r3gq-49p4-mmj6

Authentication Bypass Oracle Oracle Vm Virtualbox Oracle Corporation

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Requires local high-privileged host logon (AV:L/PR:H) and a hard-to-meet condition (AC:H); hypervisor boundary crossing yields S:C with total C:H/I:H/A:H impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:59 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24455

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker with logon access to the host to take over VirtualBox, with a scope change that can significantly impact additional products beyond the hypervisor itself. Disclosed in Oracle's April 2026 Critical Patch Update with a CVSS 3.1 base score of 7.5 and full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none with the flaw rated not automatable.

Technical ContextAI

The affected technology is the Core component of Oracle VM VirtualBox, a Type-2 hypervisor that runs guest virtual machines on top of a host operating system. The CWE-284 (Improper Access Control) classification, combined with the vendor tag 'Authentication Bypass', indicates the root cause is a failure to properly enforce access or trust boundaries within the virtualization core - the layer that mediates between guest VMs and host resources. The scope-change indicator (S:C in the CVSS vector) is characteristic of hypervisor escape or trust-boundary crossing, where activity within the vulnerable component (VirtualBox) impacts resources managed by a separate security authority such as the host OS or other guests. The CPE cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox identifies the affected product as the VirtualBox application, with EUVD confirming version 7.2.6 as impacted.

RemediationAI

Patch available per vendor advisory: apply the fixes from Oracle's April 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuapr2026.html), which is the primary and recommended remediation; upgrade Oracle VM VirtualBox past 7.2.6 to the patched release identified in that CPU (an exact fixed version is not stated in the provided data, so confirm the target build directly from Oracle's advisory before deploying). Because exploitation requires high host privileges and local logon (AV:L/PR:H), effective compensating controls where immediate patching is not possible include restricting and auditing accounts that have administrative/logon access to hosts running VirtualBox, minimizing the number of high-privilege users on virtualization hosts, and isolating VirtualBox hosts from untrusted users and workloads; the trade-off is operational friction for administrators who legitimately need host access, but it directly shrinks the population of actors able to meet the PR:H precondition. Avoid running untrusted guests on hosts holding sensitive data given the scope-change impact.