What is the CVSS score of EUVD-2026-24454?

EUVD-2026-24454 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Oracle VM VirtualBox are affected by EUVD-2026-24454?

Oracle VM VirtualBox 7.2.6 contains a network-accessible denial-of-service vulnerability in its remote desktop service that allows unauthenticated attackers to completely crash the virtualization…

How to fix or mitigate EUVD-2026-24454?

Within 24 hours, identify all VirtualBox 7.2.6 systems with VRDP/RDP services exposed and document their business criticality; immediately disable VRDP if not actively required for operations. Within 7 days, restrict VRDP network access via firewall rules to specific trusted IPs only, implement dedicated network segmentation for VRDP traffic, and deploy monitoring to alert on connection attempts from unauthorized sources. Within 30 days, develop an upgrade strategy to newer VirtualBox versions as patches become available, and conduct a business continuity review of dependencies on affected virtualization hosts to identify failover or redundancy options.

Oracle VM VirtualBox EUVD-2026-24454

| CVE-2026-35245 HIGH

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-9qx2-6rq5-w5jj

Authentication Bypass Oracle Oracle Vm Virtualbox Oracle Corporation

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network reachability over VRDP yields AV:N/AC:L/PR:N/UI:N; impact is a pure availability crash (A:H) with no confidentiality or integrity effect and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:00 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24454

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via RDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over the VirtualBox Remote Desktop Protocol (VRDP/RDP) service trigger a hang or repeatable crash, producing a complete availability loss of the virtualization host process. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 12th percentile), so while the flaw is network-reachable and unauthenticated, real-world exploitation pressure currently appears minimal. Note that the supplied 'Authentication Bypass' tag conflicts with the availability-only CVSS vector - the confirmed impact is DoS, not auth bypass.

Technical ContextAI

The affected technology is Oracle VM VirtualBox, a widely used type-2 hypervisor, specifically its Core component and its built-in remote display service (VRDP), which speaks the RDP protocol to allow remote console access to guest VMs. The CPE cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:* identifies the Oracle VirtualBox application as the affected product. The assigned root-cause class is CWE-284 (Improper Access Control); combined with the described crash/hang, this most plausibly reflects the RDP-facing parser or session handling accepting malformed input that it does not properly validate, terminating the VM/host process rather than an actual privilege or authentication bypass despite the misleading vendor tag.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of April 2026 (https://www.oracle.com/security-alerts/cpuapr2026.html) - Patch available per vendor advisory; an exact fixed VirtualBox build number was not provided in the source data, so confirm the target version in the CPU matrix before deploying. As an immediate compensating control until patched, disable the VirtualBox Remote Desktop (VRDP) server for VMs that do not require remote console access (VBoxManage modifyvm <vm> --vrde off), which fully removes the attack surface at the cost of losing remote display for those VMs. If VRDP must remain enabled, restrict access by binding it to loopback or a management-only interface and firewalling the VRDP port (default 3389) so only trusted administrative hosts can reach it, and enable VRDP authentication - the trade-off is added connection friction and tighter network segmentation requirements. Because the impact is DoS only, no data-exposure containment is needed, but ensure affected hypervisor hosts are monitored for repeated crash/restart patterns.