EUVD-2026-46533
GHSA-97qm-242g-q522
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged host logon
-
DeliveryInvoke vulnerable VirtualBox Core interface
-
ExploitTrigger flaw in privileged component
-
ExecutionEscalate to VirtualBox takeover
-
ImpactControl host VMs and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have a valid low-privileged logon session on the host where Oracle VM VirtualBox 7.2.12 executes (PR:L, AV:L) - it cannot be launched remotely over a network. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local access exists, exploitation is straightforward against the affected version. The limiting factors are the mandatory local authenticated foothold and the specific affected release (7.2.12, Core component); hosts without interactive/local access for untrusted users are not exposed via this vector. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally exploitable, low-complexity flaw requiring only low privileges and no user interaction, yielding complete takeover of VirtualBox - a genuinely serious local escalation. However, the local attack vector meaningfully bounds real-world risk: an attacker must already have an authenticated foothold on the host, so this is a privilege-escalation/second-stage issue rather than an internet-facing entry point. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; absence of these signals suggests this is not currently known to be exploited but does not rule it out. Note a data conflict: the vendor tags label this 'Information Disclosure,' yet the CVSS shows C:H/I:H/A:H and the description states 'takeover,' indicating impact well beyond disclosure - treat the CVSS/description as authoritative and the tag as imprecise. |
| Exploit ScenarioDerived | An attacker who already holds an ordinary, low-privileged local account on a workstation or server running Oracle VM VirtualBox 7.2.12 runs a crafted local program or issues crafted requests to the vulnerable Core component, escalating to full control of the VirtualBox instance and its VMs. Because the attack is local, low-complexity, and needs no user interaction, it is reliable once host access is obtained; no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged attacker with a logon session on the host where VirtualBox runs to fully compromise the VirtualBox instance, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. It was disclosed by Oracle in the July 2026 Critical Patch Update.
RemediationAI
Apply the fix delivered in Oracle's July 2026 Critical Patch Update by upgrading to the patched VirtualBox release listed at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory; an exact fixed version number is not stated in the provided data, so consult the advisory for the precise build). Until patched, reduce exposure by restricting interactive/logon access to hosts running VirtualBox to trusted administrators only, since exploitation requires a local low-privileged session; avoid running untrusted workloads or granting shell access on VirtualBox hosts, and shut down or isolate non-essential VMs. These access-restriction controls trade off multi-user convenience and shared-host usability but directly remove the local foothold the attack depends on.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle VM VirtualBox is a widely used cross-platform type-2 hypervisor; the affected 'Core' component covers the hypervisor engine and privileged host-side services (VBoxSVC, kernel drivers, and IPC surfaces) that mediate between guest VMs and the host. Vulnerabilities in this component typically stem from the trust boundary between an unprivileged local user or guest context and the higher-privileged host process, class flaws such as improper input validation, memory corruption, or insecure privilege handling. No CWE was assigned in the input, so the exact root-cause class cannot be confirmed; the CPE 'cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:*' identifies the product but is wildcarded on version, while the description pins the affected release to 7.2.12.
Know when Oracle Vm Virtualbox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires an existing low-privileged local logon (AV:L, PR:L) with no user interaction and low complexity, yielding full takeover, so C/I/A all High.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle VM VirtualBox 7.2.12 contains a local privilege escalation vulnerability enabling authenticated users with logon access to host systems to achieve complete compromise of VirtualBox instances and all resident guest virtual machines. Organizations using VirtualBox to isolate production workloads face direct threats to confidentiality, integrity, and availability of virtualized infrastructure and the applications running within.
Restrict host logon access to authenticated administrators only; deploy endpoint detection and response (EDR) on VirtualBox host systems to monitor suspicious process activity; segment production VirtualBox instances from networks containing low-privileged or untrusted user populations; consider temporary migration of critical workloads to alternative hypervisors until vendor patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Guest-to-host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker to take
Exploit-DB