What is the CVSS score of CVE-2026-46768?

CVE-2026-46768 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Oracle VM VirtualBox CVE-2026-46768

EUVD-2026-37457 MEDIUM

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Oracle Vm Virtualbox Authentication Bypass

6.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.0 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

6.0 MEDIUM

Local access and high guest/host privileges required; scope change reflects host-process-level DoS; no confidentiality or integrity impact present.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:29 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle VM VirtualBox 7.2.8 affects the VMSVGA virtual graphics device emulation layer, allowing a highly privileged local attacker to cause a persistent hang or fully repeatable crash of the hypervisor process. The CVSS Scope:Changed metric signals that the DoS impact propagates beyond the attacker's own guest VM, potentially destabilizing the host process and all co-resident VMs - a meaningful concern in multi-tenant and VDI environments. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Obtain high-privileged guest VM session

Delivery

Confirm VMSVGA adapter is active

Exploit

Craft malformed VMSVGA device commands

Install

Submit commands to VirtualBox device emulator

Trigger fault in VMSVGA emulation layer

Execute

VirtualBox host process hangs or crashes

Impact

Host and all co-resident VMs denied service

Recon

Obtain high-privileged guest VM session

Delivery

Confirm VMSVGA adapter is active

Exploit

Craft malformed VMSVGA device commands

Install

Submit commands to VirtualBox device emulator

Trigger fault in VMSVGA emulation layer

Execute

VirtualBox host process hangs or crashes

Impact

Host and all co-resident VMs denied service

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to hold high-privileged local access (PR:H, AV:L) to the infrastructure running Oracle VM VirtualBox 7.2.8 - specifically, administrative control over a guest VM whose graphics controller is configured as VMSVGA. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 6.0 accurately reflects a moderate, constrained severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A guest VM administrator on a shared VirtualBox 7.2.8 host - such as a tenant in a cloud or VDI environment - sends a sequence of crafted commands or malformed state to the VMSVGA virtual graphics device from within their guest. The fault propagates into the VirtualBox host process, triggering a hang or crash that brings down all VMs running on that hypervisor, denying service to all other tenants. …
Remediation	The primary remediation is to apply Oracle's patch as detailed in the June 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspujun2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.