What is the CVSS score of CVE-2026-35250?

CVE-2026-35250 has a CVSS 3.1 base score of 2.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Oracle VM VirtualBox CVE-2026-35250

EUVD-2026-24461 LOW

Improper Access Control (CWE-284)

2026-04-21 oracle

Authentication Bypass Denial Of Service Oracle Oracle Vm Virtualbox Oracle Corporation

2.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

2.3 LOW

Local-only attack vector with high-privilege requirement and only partial availability impact fully justifies AV:L/PR:H/A:L; no confidentiality or integrity impact applies.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:42 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24461

CVE Published

Apr 21, 2026 - 20:35 nvd

LOW 2.3

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 2.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Partial denial-of-service in Oracle VM VirtualBox 7.2.6 Core component allows a locally authenticated, high-privileged attacker to degrade availability of the hypervisor. Exploitation is limited to the local system and requires pre-existing administrative-level access, with no confidentiality or integrity impact. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog; EPSS at 0.01% (2nd percentile) reflects near-zero exploitation probability.

Technical ContextAI

Oracle VM VirtualBox is a cross-platform type-2 hypervisor; the Core component handles VM lifecycle, device emulation, and privilege separation between guest and host. CWE-284 (Improper Access Control) indicates the root cause is insufficient enforcement of access boundaries within the Core subsystem - a privileged local user can invoke functionality in a way that triggers a partial availability disruption (e.g., service hang, resource exhaustion, or crash) without crossing confidentiality or integrity boundaries. The CPE string (cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:*) is intentionally broad, but Oracle's advisory and EUVD data confirm scope is limited to version 7.2.6 specifically. Scope is unchanged (S:U), meaning exploitation cannot pivot from the VirtualBox process to the underlying host OS or adjacent VMs.

RemediationAI

Consult Oracle's Critical Patch Update for April 2026 at https://www.oracle.com/security-alerts/cpuapr2026.html to obtain the patched VirtualBox release; Oracle typically provides an updated build within the same minor version line (7.2.x). No exact fix version number is independently confirmed beyond the advisory reference, so obtain the specific patched binary directly from Oracle's download portal or package repositories. Given the low CVSS score, high privilege requirement, and local-only attack vector, the practical compensating control is ensuring that only trusted, authorized administrators have logon access to hosts running VirtualBox - restricting local host access limits exposure entirely, with no meaningful operational trade-off. There is no requirement to disable the product or restrict network access, as the attack vector is local.