What is the CVSS score of CVE-2026-46815?

CVE-2026-46815 has a CVSS 3.1 base score of 3.2 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle VM VirtualBox CVE-2026-46815

EUVD-2026-37332 LOW

Information Exposure (CWE-200)

2026-06-16 oracle

Oracle Oracle Vm Virtualbox Information Disclosure

3.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.2 LOW

AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

vuln.today AI

3.2 LOW

Local-only vector, high privileges required to access VMSVGA device; scope change justified by cross-VM data read; confidentiality impact only.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:25 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N).

AnalysisAI

Information disclosure in the VMSVGA device component of Oracle VM VirtualBox 7.2.8 enables a highly privileged local attacker already present on the virtualization host to read a subset of VirtualBox-accessible data. The scope change (S:C) in the CVSS vector is the most operationally significant element - exploitation can impact components beyond the VirtualBox process itself, potentially reaching adjacent VMs or host resources. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain high-privilege local access to VirtualBox host

Delivery

Identify VM configured with VMSVGA graphics adapter

Exploit

Interact with VMSVGA device emulation component

Execution

Trigger out-of-bounds or unauthorized read

Impact

Exfiltrate subset of cross-scope VirtualBox-accessible data

Access

Obtain high-privilege local access to VirtualBox host

Delivery

Identify VM configured with VMSVGA graphics adapter

Exploit

Interact with VMSVGA device emulation component

Execution

Trigger out-of-bounds or unauthorized read

Impact

Exfiltrate subset of cross-scope VirtualBox-accessible data

Vulnerability AssessmentAI

Exploitation	Exploitation requires local logon to the physical or virtual infrastructure host where Oracle VM VirtualBox 7.2.8 executes, combined with high operating-system privileges (administrator or root equivalent) on that host. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Real-world risk is low despite the scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with administrative privileges already established on the VirtualBox host (e.g., a rogue sysadmin, a compromised privileged account, or an attacker who has escalated privileges through a separate vulnerability) interacts with the VMSVGA device emulation in VirtualBox 7.2.8 to trigger the information disclosure. The read access obtained could expose data accessible within a different security scope, such as memory regions belonging to another guest VM or the host process. …
Remediation	Consult Oracle's June 2026 Critical Patch Update at https://www.oracle.com/security-alerts/cspujun2026.html for the patched release; the advisory is the authoritative source for the exact fix version, which is not independently specified in the available intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report.