Oracle VM VirtualBox EUVD-2026-24456

Exploitation requires direct local logon to the physical or virtual infrastructure where Oracle VM VirtualBox 7.2.6 executes, with high operating system privileges (CVSS PR:H, AV:L). The attacker must possess administrative-level credentials on the host - not merely a guest VM user account. No network-based exploitation path exists per the CVSS local attack vector. No user interaction by a separate victim is required (UI:N). The 'Authentication Bypass' tag suggests that the flaw may allow a high-privileged attacker to bypass VirtualBox-internal access controls, but this does not reduce the baseline OS privilege requirement. Exploitation is limited by: high privilege bar on the host, local-only access requirement, and the absence of any automation path (SSVC: Automatable=no). This significantly narrows the realistic attacker population to insiders, compromised admin accounts, or attackers who have already achieved host compromise by other means.

Multiple signals converge on low-to-moderate real-world risk despite the scope change. The CVSS base score of 6.0 reflects the S:C elevation but is tempered by AV:L (local) and PR:H (high privileges), meaning exploitation requires an attacker who already has administrative control over the host - a position from which many attacks are already possible without this CVE. EPSS at 0.01% (2nd percentile) indicates extremely low observed exploitation probability in the wild. SSVC corroborates: exploitation status is none, the attack is not automatable, and technical impact is rated partial. The 'Authentication Bypass' tag introduces a mild ambiguity: it is possible that a high-privileged-but-not-root user can bypass a secondary VirtualBox access control layer to read data they should not see, which would be a more meaningful intra-system boundary violation - but this is inferred from the tag and not explicitly confirmed by the description. No public exploit code is identified. The combination of a non-network attack vector, high privilege requirement, zero KEV listing, and sub-1% EPSS makes this a low operational priority for most environments unless VirtualBox hosts are shared multi-tenant infrastructure.

An attacker who has already obtained administrative or root-level access to a physical or virtual host running Oracle VM VirtualBox 7.2.6 leverages the CWE-284 access control flaw in the Core component to read confidential data from the VirtualBox process space - potentially including memory, configuration, or virtual disk content from one or more hosted VMs. Because the CVSS scope change indicates impact beyond the primary component, the attacker may be able to access data belonging to other VMs co-hosted on the same infrastructure. No public exploit code is currently available.