EUVD-2026-46541
GHSA-84mq-88rw-hh26
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
Local access with high privileges required; limited integrity impact with scope change to adjacent components; no confidentiality or availability impact confirmed.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.2 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N).
AnalysisAI
Oracle VM VirtualBox 7.2.12 Core component contains a local integrity vulnerability enabling a highly privileged attacker with host logon access to make unauthorized modifications to VirtualBox-accessible data, with potential cross-boundary impact on additional products due to scope change (S:C). The constraint to local, high-privilege access (AV:L/PR:H) limits the realistic threat surface to insider threats or post-compromise scenarios on hypervisor hosts. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
Oracle VM VirtualBox is a type-2 hypervisor running atop a host OS, managing guest virtual machine execution; the affected component is its Core subsystem in version 7.2.12 (CPE: cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:*). The CVSS scope change indicator (S:C) is particularly significant in a hypervisor context, as it signals the vulnerability crosses the VirtualBox security boundary and can affect components outside it - likely guest VMs or host-level data stores. No CWE root-cause class was assigned (listed N/A), though the advisory tags include 'Authentication Bypass,' suggesting the flaw may involve improper enforcement of internal privilege or access controls within the Core component. The low attack complexity (AC:L) indicates no special race conditions or environmental prerequisites beyond the privileged access itself.
RemediationAI
Consult Oracle's July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the official patch; the exact patched version is not independently confirmed from available data - Oracle CPUs typically deliver fixes in the next quarterly patch bundle and organizations should apply Oracle's recommended patch immediately. As a compensating control where patching is delayed, restrict host logon access to the VirtualBox infrastructure to the minimum set of users requiring it, since exploitation mandates high-privileged local access (PR:H/AV:L); this does not eliminate the risk but significantly narrows the attacker population. Implement integrity monitoring on VirtualBox-accessible data directories to provide detective coverage for unauthorized modifications, noting this introduces operational overhead from alert triage.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today