EUVD-2026-24457
GHSA-98wp-jqw8-cr49
Severity by source
AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Local-only access with high privileges and high complexity align with description; S:C reflects hypervisor-layer scope change with limited C/I/A impact across the boundary.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L).
AnalysisAI
Oracle VM VirtualBox 7.2.6 contains an improper access control flaw in its Core component that enables a highly privileged local attacker to partially compromise confidentiality, integrity, and availability - with a scope change indicating potential bleed beyond the VirtualBox process boundary to adjacent products or guest VMs on the same host. Exploitation requires local logon with high privileges and high attack complexity, making opportunistic exploitation unlikely; EPSS at the 2nd percentile and SSVC exploitation status of 'none' corroborate low real-world risk. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability resides in the Core component of Oracle VM VirtualBox 7.2.6 (CPE: cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:*), the fundamental virtualization engine responsible for CPU emulation, memory management, and hardware abstraction. CWE-284 (Improper Access Control) identifies the root cause class as insufficient enforcement of access boundaries, which in a hypervisor context is particularly sensitive - the virtualization layer is the trust boundary separating guest VMs from the host and from each other. The CVSS scope change metric (S:C) reflects that a successful exploit, despite originating locally within the VirtualBox process, can affect resources beyond the VirtualBox security boundary, consistent with partial hypervisor-layer access control bypass. The 'Authentication Bypass' tag from VulDB aligns with CWE-284 in suggesting that access decisions within VirtualBox's Core are not properly enforced, though this conflicts somewhat with the PR:H CVSS metric, which requires the attacker to already hold high privileges.
RemediationAI
Apply the Oracle Critical Patch Update for April 2026, which addresses this vulnerability; consult https://www.oracle.com/security-alerts/cpuapr2026.html for the specific patched VirtualBox version. The exact fix version number is not independently confirmed in the available reference data - verify the current supported release directly from Oracle downloads before upgrading. As a compensating control prior to patching, restrict local logon access to VirtualBox host infrastructure to the minimum set of trusted accounts, directly reducing the PR:H attacker pool. In shared or multi-tenant environments, isolate VirtualBox hosts so that the scope-change impact radius is bounded; avoid co-locating sensitive VMs on hosts where broader privileged access is granted to untrusted parties. Disabling non-essential VirtualBox Core features may reduce attack surface, though Oracle has not specified which configuration elements are implicated.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today