What is the CVSS score of CVE-2026-35251?

CVE-2026-35251 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Oracle VM VirtualBox are affected by CVE-2026-35251?

VirtualBox 7.2.6 deployments are vulnerable to insider compromise if privileged user accounts are misused or compromised; an attacker with existing high-level host access could take control of the…

How to fix or mitigate CVE-2026-35251?

Within 24 hours, inventory all systems running VirtualBox 7.2.6 and map which user accounts have administrative access to hypervisor hosts. Within 7 days, implement host-level access controls restricting administrative privileges to only necessary users, disable unnecessary guest-to-host integration features (shared folders, clipboard sharing), and establish monitoring for unusual VirtualBox process behavior. Within 30 days, establish a vendor advisory monitoring process and prepare a deployment plan for when Oracle releases a patch; evaluate architectural options to minimize reliance on local privileged access or consider alternative hypervisors if local access controls cannot be adequately enforced.

Oracle VM VirtualBox CVE-2026-35251

EUVD-2026-24463 HIGH

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-fpcq-h389-8ggm

Authentication Bypass Oracle Oracle Vm Virtualbox Oracle Corporation

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Requires high-privileged local logon on the host (AV:L/PR:H), success is condition-dependent (AC:H), and hypervisor takeover crosses into the host/guests (S:C) with full C/I/A loss.

3.1 AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:41 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24463

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker who is already logged onto the host running VirtualBox to take over the VirtualBox instance, with a scope change that can significantly impact additional products beyond the hypervisor itself. The flaw is classed as improper access control (CWE-284) and tagged as an authentication bypass, yielding total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and EPSS is negligible (0.01%), consistent with the high attack complexity and privilege requirements.

Technical ContextAI

Oracle VM VirtualBox is a cross-platform Type-2 hypervisor that runs guest virtual machines on a host operating system; the vulnerable 'Core' component covers the central virtualization engine (VMM, device emulation, and host/guest boundary enforcement). The CPE cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox identifies the affected software, with EUVD confirming version 7.2.6 specifically. The root cause is CWE-284 (Improper Access Control): a control that should restrict an actor's ability to reach a protected resource or capability is not correctly enforced. Combined with the vendor's 'Authentication Bypass' tag and the CVSS scope-change flag (S:C), this indicates the weakness lets an actor cross the trust boundary enforced by the hypervisor, so that compromising VirtualBox can reach resources managed by another security authority (e.g., the host or other guests).

RemediationAI

Apply the fix from the Oracle April 2026 Critical Patch Update; the specific patched build was not provided in this intelligence, so consult https://www.oracle.com/security-alerts/cpuapr2026.html for the exact corrected VirtualBox version and upgrade 7.2.6 hosts accordingly (Patch available per vendor advisory; released patched version not independently confirmed from the data provided). As compensating controls until patched, restrict who holds administrative/high-privilege logon rights on hosts that run VirtualBox, since exploitation requires PR:H local access - reducing the pool of privileged host accounts directly shrinks the attack surface, at the cost of tighter operational access. Avoid running untrusted or multi-tenant workloads on the same host as sensitive VMs given the scope-change (host/other-product) impact, and monitor host administrative sessions for anomalous activity; these controls do not remove the flaw and should be treated as interim measures. Reference advisories: https://www.oracle.com/security-alerts/cpuapr2026.html, https://nvd.nist.gov/vuln/detail/CVE-2026-35251, and https://vuldb.com/vuln/358720.