Oracle VM VirtualBox CVE-2026-35250

Exploitation requires an attacker to hold a high-privileged account (e.g., administrator or root) with an active local logon session on the physical or virtual host where Oracle VM VirtualBox 7.2.6 is installed and running. The attack cannot be performed remotely - AV:L confirms physical or logical local access is mandatory. No user interaction from a separate user is required (UI:N). The scope does not change (S:U), so a successful attacker cannot leverage this to compromise the underlying host OS or adjacent VMs. Exploitation is bounded to partial availability disruption only; there is no path to information disclosure or data modification. The primary limiting factor is the combination of required local access and high-privilege prerequisite, which dramatically reduces the population of potential attackers to insiders or already-compromised privileged accounts.

All available signals consistently indicate very low real-world risk. The CVSS base score of 2.3 is one of the lowest possible meaningful scores, driven by AV:L (local-only), PR:H (high privileges), and A:L (partial, not complete, availability impact). EPSS corroborates this at 0.01% probability of exploitation within 30 days (2nd percentile globally). SSVC classification is Exploitation: none, Automatable: no, Technical Impact: partial - affirming this is not a candidate for emergency remediation. CISA KEV listing is absent and no POC has been identified. The 'Authentication Bypass' tag in the source intelligence is discordant with the CVSS vector (PR:H requires high-privileged access by definition) and the description (which explicitly states 'high privileged attacker'); this tag may be a mis-categorization or metadata artifact and should not be treated as confirmed. The vulnerability should be treated as a routine low-severity item, addressable via normal patch cycle rather than emergency response.

An administrator or operator account already authenticated to the host operating system invokes a crafted operation against the VirtualBox Core component, causing the hypervisor to enter a degraded state and partially losing availability for running guest VMs. No public proof-of-concept code has been identified at time of analysis. Because attack complexity is low (AC:L), a skilled local attacker with the required privileges could reliably trigger the condition without trial-and-error.