What is the CVSS score of CVE-2026-35275?

CVE-2026-35275 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Oracle VM VirtualBox are affected by CVE-2026-35275?

Oracle VM VirtualBox 7.2.8 contains a flaw that allows local users to gain control of host systems and access sensitive data across virtualized infrastructure.

How to fix or mitigate CVE-2026-35275?

Within 24 hours: Create inventory of Oracle VirtualBox 7.2.8 deployments, assess data sensitivity on host systems, and disable Shared Folders if not business-critical. Within 7 days: Deploy the patch from Oracle's June 2026 Critical Patch Update (CVE-2026-35275) to all affected VirtualBox instances. Within 30 days: Complete verification that all VirtualBox systems are patched and document remediation completion.

Oracle VM VirtualBox CVE-2026-35275

EUVD-2026-37405 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Vm Virtualbox

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

7.5 HIGH

Local logon required (AV:L, PR:L), High complexity per Oracle (AC:H), Shared Folders crosses VirtualBox→host boundary (S:C), data read/write but no DoS (C:H/I:H/A:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:22 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Shared Folders). The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privileged local attacker on the host to escape the guest/host boundary and access or modify critical data across the scope, including resources outside VirtualBox itself. The flaw is rated CVSS 3.1 7.5 with a scope change, but exploitation is rated High complexity by Oracle and there is no public exploit identified at time of analysis. Patch is available per Oracle's June 2026 Critical Patch Update advisory.

Technical ContextAI

The defect resides in the Shared Folders component of Oracle VM VirtualBox, a Type-2 hypervisor (CPE cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox). Shared Folders is the VirtualBox feature that exposes selected host directories into guest VMs via a paravirtualized file-system protocol implemented by the VBoxSharedFolders host service and the guest-side vboxsf driver. Bugs in this surface historically include path traversal, symlink handling errors, and improper validation of guest-supplied requests (CWE-22/CWE-59/CWE-20 class issues); no CWE is published for this CVE, but the scope-changed C/I impact with local vector is consistent with a guest-to-host data access flaw mediated through the Shared Folders channel.

RemediationAI

Apply the fix from Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html); the input does not name a specific patched build number, so treat this as 'Patch available per vendor advisory' and install the VirtualBox release listed in that CPU as superseding 7.2.8. Until the host can be patched, the most surgical compensating control is to disable Shared Folders on every VM (remove all shared-folder mappings and set auto-mount/permanent flags off), which eliminates the vulnerable surface at the cost of losing host/guest file exchange - fall back to scp, virtual disks, or clipboard transfer. Additionally, restrict interactive logon on VirtualBox hosts to administrators only and avoid running untrusted guest VMs on multi-tenant hosts, since the attacker needs a local account to reach the bug.