EUVD-2026-46568
GHSA-8xgp-jfpq-vf7g
Severity by source
AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L
Local vector with high privilege and complexity confirmed by description; scope change and high confidentiality loss with only partial availability impact align with Oracle's disclosed vector.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L).
AnalysisAI
Oracle VM VirtualBox 7.2.12 contains a Core component vulnerability exploitable by high-privileged local attackers that produces a scope change, potentially compromising systems beyond VirtualBox itself. Successful exploitation yields complete confidentiality loss of all VirtualBox-accessible data and a partial denial of service, making this an isolation-breach risk in multi-tenant or shared virtualization environments. No public exploit identified at time of analysis, and the AC:H rating signals difficult exploitation, but the scope change (S:C) elevates real-world concern for environments where VirtualBox hosts sensitive guest workloads.
Technical ContextAI
Oracle VM VirtualBox (CPE: cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:*) is a type-2 hypervisor whose Core component manages critical VM lifecycle operations including memory, device emulation, and guest-host communication. The CVSS vector AV:L/S:C indicates an attack confined to local infrastructure that nevertheless crosses a security boundary - a classic indicator of a hypervisor escape or privilege escalation from a privileged guest or host context into adjacent resources. The tags include 'Authentication Bypass', which, combined with the PR:H prerequisite, suggests the flaw may allow an already-privileged attacker to bypass an internal VirtualBox authentication or access-control mechanism to reach data or components they should not access. CWE is listed as N/A - the precise root cause class (e.g., improper access control, memory safety flaw) is not disclosed by Oracle in this advisory, which is consistent with Oracle's CPU disclosure policy of withholding technical root-cause details.
RemediationAI
Apply the patch included in Oracle's Critical Patch Update for July 2026, available via the Oracle Security Alerts page at https://www.oracle.com/security-alerts/cpujul2026.html. An exact replacement version number is not independently published in the available advisory references beyond the CPU itself - consult the CPU documentation for the precise patched build. As a compensating control where immediate patching is not feasible, restrict logon access to VirtualBox host infrastructure to the minimum set of required administrators, reducing the pool of accounts that could meet the PR:H prerequisite. Additionally, audit and enforce least-privilege principles for any accounts with VirtualBox management rights, as this directly constrains exploitation viability. Restricting host-level shell or RDP access to VirtualBox servers via network segmentation or jump-host controls provides further reduction of attack surface, though it does not eliminate the vulnerability.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today