Oracle VM VirtualBox EUVD-2026-46541

Exploitation requires the attacker to have high-privileged logon access (PR:H) to the physical or virtual infrastructure host executing Oracle VM VirtualBox 7.2.12 - this is a strictly local attack (AV:L) with no remote exploitation path. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning once the privileged local access is established, no further special conditions, race conditions, or non-default configurations are needed. The primary limiting factor is the mandatory high-privilege local access: remote attackers, unprivileged local users, and guest VM users cannot trigger this vulnerability without first escalating to host-level high privileges. The 'Authentication Bypass' tag suggests the bypass operates within VirtualBox's internal access controls rather than at the OS authentication layer, but the specific feature or configuration involved is not named in the available description.

The vendor-assigned CVSS 3.1 base score of 3.2 (Low) accurately reflects the significant constraints on exploitation: local attack vector (AV:L) and high privilege requirement (PR:H) mean an attacker must already hold elevated host OS access, making this essentially a post-compromise or insider-threat scenario. The scope change (S:C) is the most noteworthy signal - in hypervisor products, cross-boundary impact can mean guest VM data integrity is at risk from a compromised privileged host account. No EPSS score is available in the provided data, and the absence of CISA KEV listing combined with no identified public POC further depresses real-world urgency. The impact is limited to integrity (I:L) with no confidentiality or availability consequences. Overall, this is a genuine low-priority issue unless the threat model specifically includes privileged insider access to VirtualBox hosts - in that case the scope change warrants attention.

A system administrator or privileged operator with existing high-privilege logon access to the host running Oracle VM VirtualBox 7.2.12 exploits an authentication bypass condition within the Core component to perform unauthorized data modifications - for example, altering VM disk images or configuration files that VirtualBox manages. Because the CVSS scope change (S:C) applies, these modifications could propagate to affect guest VM integrity or other components on the host beyond VirtualBox itself. No public exploit code has been identified, so exploitation currently requires attacker-developed tooling.