EUVD-2026-46536
GHSA-8q6f-9v43-x28c
Severity by source
AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H
Local, low-complexity but gated by high host privileges (PR:H) and required second-user interaction (UI:R); scope change plus high integrity/availability loss and no confidentiality impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:H).
AnalysisAI
Integrity and availability compromise in Oracle VM VirtualBox 7.2.8 (Core component) allows a high-privileged local user, with the aid of a separate tricked user, to modify or destroy critical data and force a complete denial of service, with impact crossing into additional products due to a scope change. Rated CVSS 3.1 7.4 and disclosed in Oracle's July 2026 Critical Patch Update, it carries no confidentiality impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Oracle VM VirtualBox is a type-2 hypervisor that runs guest virtual machines on a host operating system; the affected 'Core' component covers the central virtualization engine (VMM, device emulation, and VM lifecycle handling) that mediates between guest VMs and host resources. The CVSS scope change (S:C) is characteristic of a hypervisor boundary issue where activity within the VirtualBox trust zone can affect resources managed by a different security authority - consistent with the advisory noting that attacks 'may significantly impact additional products.' No CWE was assigned by the source, so the precise root-cause class (e.g., improper input handling or state corruption in the core engine) cannot be confirmed from the provided data; the CPE cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox identifies the affected application generically without pinning a version range.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026; patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html - consult that advisory for the exact fixed VirtualBox build corresponding to the 7.2.8 branch, as a specific fix version was not included in the provided data and should not be assumed. Because exploitation requires an already high-privileged host account plus interaction from a second user, effective compensating controls until patching are to restrict and audit administrative/high-privilege accounts on VirtualBox hosts, avoid running VirtualBox on shared or multi-user hosts, and limit which users can launch or interact with VM sessions (reducing the availability of the required second user); the trade-off is reduced operational flexibility on shared virtualization hosts. Avoid opening VMs or configuration artifacts supplied by untrusted parties, which addresses the required-human-interaction vector.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today