EUVD-2026-37367Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Local high-privilege access confirmed by description; scope change to adjacent products warranted; only low confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N).
AnalysisAI
Oracle VM VirtualBox 7.2.8 Core component exposes a local information disclosure path exploitable by a high-privileged attacker already logged on to the host infrastructure, resulting in unauthorized read access to a subset of VirtualBox-accessible data. The CVSS scope change (S:C) indicates the read impact may cross virtualization boundaries and affect additional products - such as guest VMs - beyond the VirtualBox process itself. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, placing this in a low-urgency but operationally meaningful category for multi-tenant virtualization environments.
Technical ContextAI
Oracle VM VirtualBox is a type-2 (hosted) hypervisor running on general-purpose operating systems. The affected component is Core - the central hypervisor engine responsible for VM execution, guest-host isolation, and resource management. The CPE string cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:* identifies Oracle Corporation's VirtualBox product family; EUVD-2026-37367 pins the specific affected release to version 7.2.8. No CWE is assigned by Oracle or NVD, so the precise root cause class is unconfirmed. The 'Authentication Bypass' tag in available intelligence is notable but potentially misleading: the CVSS vector carries PR:H (high privileges already required), suggesting the bypass may refer to circumvention of an internal VirtualBox isolation or privilege-check mechanism - not an external authentication boundary - once an admin-level account is already present. The scope change (S:C) is the technically significant signal, implying the flaw allows a host-side privileged actor to read data that conceptually belongs to a different security principal, such as a guest VM.
RemediationAI
Apply Oracle's June 2026 Critical Security Patch Update as directed at https://www.oracle.com/security-alerts/cspujun2026.html. The available references confirm version 7.2.8 is affected but do not specify an exact patched release number - consult Oracle's advisory directly to identify the minimum fixed version and upgrade accordingly. As compensating controls prior to patching, enforce strict least-privilege access controls on accounts with local logon rights to VirtualBox host systems, particularly limiting membership in host administrator or hypervisor management groups to only operationally necessary personnel. In multi-tenant environments, audit host-side privileged accounts to ensure guest VM operators cannot escalate to host admin level. Enable hypervisor audit logging to detect anomalous access patterns to VirtualBox data structures. These controls reduce risk but do not eliminate the underlying flaw.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today