EUVD-2026-24459
GHSA-wv9q-w2v5-wfhp
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
Local logon and pre-existing high privileges are explicitly required; scope change reflects potential guest VM impact; only limited integrity modification is confirmed with no confidentiality or availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.2 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N).
AnalysisAI
Improper access control in Oracle VM VirtualBox 7.2.6's Core component allows a high-privileged local attacker with logon access to the host infrastructure to perform unauthorized writes, inserts, or deletions against VirtualBox-accessible data. Notably, Oracle's advisory confirms a scope change - successful exploitation may affect additional products beyond VirtualBox itself, such as guest VM environments sharing the same host. No active exploitation is confirmed (SSVC: none; EPSS: 0.01%, 2nd percentile), and no public exploit or POC has been identified at time of analysis.
Technical ContextAI
Oracle VM VirtualBox is a type-2 (hosted) hypervisor; the affected component is its Core subsystem, which manages VM lifecycle, device emulation, and host-guest interactions. CWE-284 (Improper Access Control) indicates the root cause is insufficient enforcement of authorization boundaries within the Core - not a memory-safety flaw but a logic failure allowing a privileged caller to perform operations outside their intended permission scope. The CVSS Scope:Changed (S:C) metric is particularly significant here: it implies the access control bypass can propagate effects beyond the VirtualBox process boundary, plausibly into guest OS contexts or co-hosted VM data. CPE cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:7.2.6 confirms only this specific release is affected per current Oracle CPU data.
RemediationAI
Apply Oracle's Critical Patch Update (CPU) for April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html, which addresses this vulnerability in VirtualBox 7.2.6. No specific fixed release version number is independently confirmed in the available data beyond the implicit CPU guidance, so consult the advisory directly for the recommended upgrade target. Where immediate patching is not feasible, the most effective compensating control - given the PR:H requirement - is strict privileged access management: limit the number of accounts with local logon rights to VirtualBox host infrastructure, enforce least-privilege principles, and audit existing high-privilege accounts. This directly shrinks the pool of identities that could reach the vulnerable code path. Restricting host console and SSH access to named administrator accounts rather than shared service accounts also aids in attribution if exploitation is attempted. These controls have no functional side effects on normal VirtualBox operation.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today