Oracle VM VirtualBox EUVD-2026-24459

Exploitation requires physical or remote logon access to the host infrastructure running Oracle VM VirtualBox 7.2.6 - this is a local attack vector (AV:L) and is not remotely exploitable from the network without pre-existing host access. The CVSS PR:H metric confirms the attacker must already hold high-level privileges on the host system (e.g., root or administrator). No user interaction is required (UI:N) once local privileged access is established. The vulnerability is confirmed only in VirtualBox 7.2.6; other versions are not listed as affected. Key limiting factors: the attacker cannot exploit this remotely from the network, must already possess elevated host credentials, and impact is restricted to data integrity with no confidentiality or availability consequence. The 'Authentication Bypass' metadata tag from VulDB conflicts with PR:H and should not be relied upon to infer that unauthenticated exploitation is possible - defenders should treat this as unverified until Oracle clarifies.

All available signals consistently place this at very low real-world risk. The CVSS 3.1 base score of 3.2 (Low) is well-supported by the vector: AV:L (no network exposure), AC:L (low complexity once local access is obtained), PR:H (attacker must already hold high host-level privileges), and impacts limited to partial integrity (I:L) with no confidentiality or availability effect. EPSS at 0.01% (2nd percentile) corroborates near-zero exploitation probability. SSVC assessment independently confirms exploitation status 'none,' the vulnerability is not automatable, and technical impact is only 'partial.' The sole elevated concern is the S:C scope change, which means that despite the low base score, defenders managing multi-tenant or shared hypervisor environments should not entirely dismiss it - a privileged actor exploiting this could affect guest workloads. One notable data inconsistency: the intelligence metadata tags this as 'Authentication Bypass,' which conflicts directly with the CVSS PR:H metric indicating high privilege is required, not bypassed. This discrepancy should be verified against Oracle's advisory before drawing conclusions about authentication requirements.

A system administrator or privileged service account already logged onto the host server running VirtualBox 7.2.6 exploits the CWE-284 access control flaw in the Core component to write or manipulate VirtualBox-accessible data beyond their authorized scope - potentially altering VM configuration data, snapshots, or metadata affecting guest VMs on the same host. Because of the S:C scope change, the data modification may propagate to affect co-hosted virtualized workloads without directly attacking them. No public exploit or POC code is known to exist.