EUVD-2026-37286Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Local high-privilege access required for VMSVGA interaction; scope change to host yields S:C; read-only limited data exposure gives C:L with no integrity or availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N).
AnalysisAI
Unauthorized read access in Oracle VM VirtualBox 7.2.8's VMSVGA device component can be triggered by a locally authenticated, highly privileged attacker, resulting in a scope-change impact that may expose a subset of confidential data from resources beyond the guest VM boundary, potentially the host layer. Oracle's June 2026 Critical Patch Update describes the flaw as easily exploitable once the high-privilege prerequisite is met, though the constrained attack surface limits realistic exposure to administrative accounts with existing local host access. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; the low CVSS base score of 3.2 reflects the narrow confidentiality-only impact and strict access requirements.
Technical ContextAI
The VMSVGA device is the emulated VMware SVGA II virtual graphics adapter used by Oracle VM VirtualBox to provide 2D and 3D graphics acceleration to guest operating systems. This component is part of VirtualBox's device emulation layer and processes graphics memory and command operations within the hypervisor boundary. The CVSS scope-change designation (S:C) indicates that exploitation can impact resources outside the initially targeted virtual machine - typically the host system or co-resident VMs - rather than remaining contained within a single guest context. The CPE string cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:* is broadly defined but Oracle's advisory and ENISA EUVD-2026-37286 both explicitly scope the affected release to version 7.2.8. CWE classification is absent from this advisory, limiting formal root-cause categorization; however, the 'Authentication Bypass' tag associated in the intelligence record may indicate an improper access-control defect within the VMSVGA device's data-access path, though the advisory description frames it as unauthorized read access rather than a bypass - this discrepancy is unresolved.
RemediationAI
The primary remediation is to apply Oracle's Critical Patch Update issued in June 2026, referenced at https://www.oracle.com/security-alerts/cspujun2026.html. The exact patched version number is not independently specified in the available data; consult Oracle's advisory directly to confirm the target upgrade release before deploying. As a compensating control prior to patching, restrict local logon access to the VirtualBox host infrastructure to only accounts with a strict operational need, reducing the pool of principals capable of meeting the PR:H prerequisite; note this does not eliminate the vulnerability but shrinks the attack surface. Switching the VM graphics controller from VMSVGA to VBoxSVGA or VBoxVGA in the VirtualBox VM settings may remove the vulnerable device emulation path as a short-term workaround, though this trade-off includes potential loss of VMware-compatible 3D acceleration and may affect guest display functionality. Strict least-privilege enforcement on host administrative accounts remains advisable as a durable defense regardless of patch status.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today