EUVD-2026-24456
GHSA-25v6-95vv-c6qq
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Local attack vector and high-privilege requirement match 'logon to infrastructure as high-privileged attacker'; scope change reflects cross-VM confidentiality impact; no integrity or availability impact described.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).
AnalysisAI
Confidentiality breach in Oracle VM VirtualBox 7.2.6 Core allows a high-privileged local attacker to gain complete read access to all data accessible by the VirtualBox process, with scope change indicating potential data leakage beyond the primary VM boundary into adjacent virtualized environments. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:C) confirms local-only exploitation requiring administrative-level host access, substantially limiting the realistic attacker pool. No active exploitation is confirmed - EPSS sits at 0.01% (2nd percentile), SSVC rates exploitation as none, and the vulnerability is absent from CISA KEV.
Technical ContextAI
Oracle VM VirtualBox is a cross-platform Type-2 hypervisor managed under Oracle Virtualization. The affected component is the Core subsystem of VirtualBox version 7.2.6, identified via CPE cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:*. The root cause is classified as CWE-284 (Improper Access Control), indicating that the Core component fails to enforce sufficient privilege separation or boundary checks when a high-privileged process accesses sensitive data. The CVSS scope change (S:C) is technically significant: it signals that successful exploitation can breach the security boundary of the VirtualBox hypervisor itself and affect resources or data outside the primary vulnerable component - consistent with potential guest-to-host data reads or cross-VM memory/data exposure. The 'Authentication Bypass' tag suggests a secondary access control mechanism within VirtualBox's internal privilege model may be circumventable after the attacker already holds OS-level high privileges on the host.
RemediationAI
Apply Oracle's Critical Patch Update released in April 2026, referenced at https://www.oracle.com/security-alerts/cpuapr2026.html. An exact patched version number beyond 7.2.6 is not confirmed in the available data - organizations should consult the Oracle CPU advisory directly to identify the target upgrade version. As a compensating control pending patch application, restrict local logon and administrative access to VirtualBox hosts to only explicitly authorized administrators, reducing the pool of potential attackers who meet the PR:H prerequisite. In multi-tenant or shared VirtualBox environments where scope change carries higher risk, consider temporarily isolating sensitive VMs or migrating them to patched hosts. Audit host-level privilege assignments and remove unnecessary administrative accounts from VirtualBox infrastructure. Note that these mitigations do not eliminate the vulnerability but reduce exploitability given the AV:L/PR:H attack prerequisites.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today