What is the CVSS score of EUVD-2026-37367?

EUVD-2026-37367 has a CVSS 3.1 base score of 3.2 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Oracle VM VirtualBox EUVD-2026-37367

| CVE-2026-46874 LOW

Information Exposure (CWE-200)

2026-06-16 oracle

Oracle Oracle Vm Virtualbox Information Disclosure

3.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.2 LOW

AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

vuln.today AI

3.2 LOW

Local high-privilege access confirmed by description; scope change to adjacent products warranted; only low confidentiality impact with no integrity or availability effect.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:22 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N).

AnalysisAI

Oracle VM VirtualBox 7.2.8 Core component exposes a local information disclosure path exploitable by a high-privileged attacker already logged on to the host infrastructure, resulting in unauthorized read access to a subset of VirtualBox-accessible data. The CVSS scope change (S:C) indicates the read impact may cross virtualization boundaries and affect additional products - such as guest VMs - beyond the VirtualBox process itself. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, placing this in a low-urgency but operationally meaningful category for multi-tenant virtualization environments.

Technical ContextAI

Oracle VM VirtualBox is a type-2 (hosted) hypervisor running on general-purpose operating systems. The affected component is Core - the central hypervisor engine responsible for VM execution, guest-host isolation, and resource management. The CPE string cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:* identifies Oracle Corporation's VirtualBox product family; EUVD-2026-37367 pins the specific affected release to version 7.2.8. No CWE is assigned by Oracle or NVD, so the precise root cause class is unconfirmed. The 'Authentication Bypass' tag in available intelligence is notable but potentially misleading: the CVSS vector carries PR:H (high privileges already required), suggesting the bypass may refer to circumvention of an internal VirtualBox isolation or privilege-check mechanism - not an external authentication boundary - once an admin-level account is already present. The scope change (S:C) is the technically significant signal, implying the flaw allows a host-side privileged actor to read data that conceptually belongs to a different security principal, such as a guest VM.

RemediationAI

Apply Oracle's June 2026 Critical Security Patch Update as directed at https://www.oracle.com/security-alerts/cspujun2026.html. The available references confirm version 7.2.8 is affected but do not specify an exact patched release number - consult Oracle's advisory directly to identify the minimum fixed version and upgrade accordingly. As compensating controls prior to patching, enforce strict least-privilege access controls on accounts with local logon rights to VirtualBox host systems, particularly limiting membership in host administrator or hypervisor management groups to only operationally necessary personnel. In multi-tenant environments, audit host-side privileged accounts to ensure guest VM operators cannot escalate to host admin level. Enable hypervisor audit logging to detect anomalous access patterns to VirtualBox data structures. These controls reduce risk but do not eliminate the underlying flaw.