Oracle Vm Virtualbox
Monthly
Oracle VM VirtualBox 7.2.12 contains a Core component vulnerability exploitable by high-privileged local attackers that produces a scope change, potentially compromising systems beyond VirtualBox itself. Successful exploitation yields complete confidentiality loss of all VirtualBox-accessible data and a partial denial of service, making this an isolation-breach risk in multi-tenant or shared virtualization environments. No public exploit identified at time of analysis, and the AC:H rating signals difficult exploitation, but the scope change (S:C) elevates real-world concern for environments where VirtualBox hosts sensitive guest workloads.
Oracle VM VirtualBox 7.2.12 on the host infrastructure is vulnerable to a local denial-of-service and limited data integrity attack requiring human interaction from a third party. An attacker with logon access to the host - but no specific privileges on VirtualBox - can trigger a complete hang or repeated crash of the hypervisor, plus unauthorized modification of a subset of accessible VM data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low complexity and no-privileges-required local vector make this straightforward to execute once host access is obtained.
Oracle VM VirtualBox 7.2.12 Core component exposes a local information disclosure path that allows a high-privileged host-level attacker to read a subset of VirtualBox-accessible data, with scope change indicating that impact can extend beyond the hypervisor process itself to adjacent resources such as guest VMs. The vulnerability is rated CVSS 3.2 (Low) and is confirmed by Oracle's July 2026 Critical Patch Update; no public exploit code and no CISA KEV listing exist. The combination of local-only access and mandatory high privileges severely constrains real-world exploitability, making this a low-priority finding for most organizations outside multi-tenant or shared-host VirtualBox deployments.
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is already logged into the infrastructure running VirtualBox to compromise the hypervisor, with a scope change (CVSS S:C) indicating impact beyond VirtualBox itself - consistent with a guest-to-host or component-crossing escape. Oracle rates it CVSS 3.1 7.5 with full confidentiality, integrity, and availability impact, though exploitation is difficult (AC:H, PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle VM VirtualBox 7.2.12 Core component allows a low-privileged local attacker, under high-complexity conditions, to break VM isolation boundaries and compromise data integrity of the hypervisor and potentially adjacent systems. Successful exploitation can result in unauthorized creation, deletion, or modification of critical VirtualBox-accessible data, along with partial denial of service. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis, but the scope change (S:C) elevates priority in multi-tenant or shared-host VirtualBox deployments where VM boundary integrity is a security guarantee.
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attacker with a logon to the host take over the VirtualBox hypervisor and, because of a scope change, impact additional products beyond VirtualBox itself. The flaw carries full confidentiality, integrity, and availability impact but is rated difficult to exploit, requiring high privileges and high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged attacker with a local logon on the host where VirtualBox executes to take over the VirtualBox installation, with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV; despite a vendor 'Information Disclosure' tag, the CVSS vector reports full C/I/A impact consistent with product takeover. Exploitation requires prior local access and low privileges, which limits mass exploitation but makes it valuable as a post-access escalation step.
Oracle VM VirtualBox 7.2.12 Core component allows a low-privileged local user to repeatedly crash or hang the hypervisor, causing a complete denial of service against all guest virtual machines running on the affected host. This vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified at time of analysis. The practical blast radius is limited to shared-access VirtualBox hosts where untrusted or semi-trusted local accounts exist, which is more common in developer workstations than hardened production environments.
Oracle VM VirtualBox 7.2.12 Core component contains a local integrity vulnerability enabling a highly privileged attacker with host logon access to make unauthorized modifications to VirtualBox-accessible data, with potential cross-boundary impact on additional products due to scope change (S:C). The constraint to local, high-privilege access (AV:L/PR:H) limits the realistic threat surface to insider threats or post-compromise scenarios on hypervisor hosts. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged attacker who can log on to the host to compromise the VirtualBox Core component with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The single vendor reference is Oracle's July 2026 Critical Patch Update advisory.
Local exploitation of the Core component in Oracle VM VirtualBox 7.2.12 allows a low-privileged attacker to perform unauthorized creation, deletion, or modification of critical VirtualBox data and cause a partial denial of service - provided a second user's interaction can be induced. Oracle disclosed this in the July 2026 Critical Patch Update (CPU), classifying it as easily exploitable under those local conditions. No public exploit code or active exploitation has been identified at time of analysis, and the mandatory human-interaction requirement (UI:R) materially constrains unassisted or automated attacks.
Integrity and availability compromise in Oracle VM VirtualBox 7.2.8 (Core component) allows a high-privileged local user, with the aid of a separate tricked user, to modify or destroy critical data and force a complete denial of service, with impact crossing into additional products due to a scope change. Rated CVSS 3.1 7.4 and disclosed in Oracle's July 2026 Critical Patch Update, it carries no confidentiality impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged attacker with a logon session on the host where VirtualBox runs to fully compromise the VirtualBox instance, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. It was disclosed by Oracle in the July 2026 Critical Patch Update.
Local denial-of-service in Oracle VM VirtualBox 7.2.12 allows a low-privileged attacker with local logon access to the host system to repeatedly crash or hang the VirtualBox process, rendering the hypervisor unavailable. The flaw resides in the Core component and requires no user interaction once the attacker has a local session on the infrastructure host. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to availability - confidentiality and integrity are unaffected.
Local privilege abuse in Oracle VM VirtualBox 7.2.12 Core component permits a high-privileged local attacker to read a subset of VirtualBox-accessible data, with confirmed scope change indicating potential exposure of data belonging to co-hosted or adjacent products. The CVSS score of 3.2 (Low) reflects the constrained attack surface - requiring local logon with high privileges - but the scope change flag (S:C) elevates the architectural concern, as information disclosed may originate outside the directly compromised VirtualBox instance. No public exploit code or active exploitation has been identified at time of analysis.
Oracle VM VirtualBox 7.2.12 Core component allows a high-privileged local attacker to cause a complete denial-of-service by crashing or hanging the hypervisor, with a scope change indicating the impact can extend beyond the primary VirtualBox process to affect additional products on the same infrastructure. The vulnerability is confirmed by Oracle's July 2026 Critical Patch Update. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized read access in Oracle VM VirtualBox 7.2.8's VMSVGA device component can be triggered by a locally authenticated, highly privileged attacker, resulting in a scope-change impact that may expose a subset of confidential data from resources beyond the guest VM boundary, potentially the host layer. Oracle's June 2026 Critical Patch Update describes the flaw as easily exploitable once the high-privilege prerequisite is met, though the constrained attack surface limits realistic exposure to administrative accounts with existing local host access. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; the low CVSS base score of 3.2 reflects the narrow confidentiality-only impact and strict access requirements.
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high privileges to take over the VirtualBox installation and cross the hypervisor boundary into additional products (scope-changed). Oracle's CPU advisory rates this CVSS 3.1 7.5 with high attack complexity; no public exploit identified at time of analysis and it is not listed in CISA KEV.
The VMSVGA virtual graphics device in Oracle VM VirtualBox 7.2.8 allows a high-privileged local attacker to cross the guest-to-host isolation boundary and gain unauthorized read access to critical data beyond the VM's intended scope. The CVSS scope change (S:C) confirms this is a hypervisor boundary violation - successful exploitation exposes host-level or cross-VM confidential data, a severe outcome in multi-tenant virtualization environments despite the moderate base score. No public exploit identified at time of analysis, and no CISA KEV listing indicates no confirmed active exploitation.
Oracle VM VirtualBox 7.2.8 Core component exposes a local information disclosure path exploitable by a high-privileged attacker already logged on to the host infrastructure, resulting in unauthorized read access to a subset of VirtualBox-accessible data. The CVSS scope change (S:C) indicates the read impact may cross virtualization boundaries and affect additional products - such as guest VMs - beyond the VirtualBox process itself. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, placing this in a low-urgency but operationally meaningful category for multi-tenant virtualization environments.
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a high-privileged local attacker to break out of the virtualization boundary and impact additional products beyond VirtualBox itself (scope change). The flaw carries a CVSS 3.1 base score of 7.5 with full confidentiality, integrity, and availability impact, but exploitation is rated high complexity. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Integrity compromise in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device component allows a highly privileged local attacker to make unauthorized modifications to critical data, with scope change indicating impact extends beyond the initially targeted VM instance. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N) confirms local-only attack surface requiring high privileges, but the confirmed scope change elevates the potential blast radius to the host or adjacent VMs. No public exploit has been identified at time of analysis, and the vulnerability is patched under Oracle's Critical Security Update for June 2026.
Local information disclosure in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a high-privileged guest or host attacker to read a subset of VirtualBox-accessible data across the VM isolation boundary. The scope change (S:C) in the CVSS vector indicates the vulnerability crosses the hypervisor boundary, making it relevant to multi-tenant or shared virtualization deployments despite the low base score of 3.2. No public exploit has been identified and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog; Oracle addressed it in the June 2026 Critical Patch Update.
Information disclosure in the VMSVGA device component of Oracle VM VirtualBox 7.2.8 enables a highly privileged local attacker already present on the virtualization host to read a subset of VirtualBox-accessible data. The scope change (S:C) in the CVSS vector is the most operationally significant element - exploitation can impact components beyond the VirtualBox process itself, potentially reaching adjacent VMs or host resources. No public exploit code and no active exploitation have been identified at time of analysis; CVSS base score of 3.2 (Low) reflects limited confidentiality impact and a high privilege bar.
Denial-of-service in Oracle VM VirtualBox 7.2.8 affects the VMSVGA virtual graphics device emulation layer, allowing a highly privileged local attacker to cause a persistent hang or fully repeatable crash of the hypervisor process. The CVSS Scope:Changed metric signals that the DoS impact propagates beyond the attacker's own guest VM, potentially destabilizing the host process and all co-resident VMs - a meaningful concern in multi-tenant and VDI environments. No public exploit code exists and no CISA KEV listing is present at time of analysis; exploitation is bounded by the requirement for high-privileged local access to the infrastructure.
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privileged local attacker on the host to escape the guest/host boundary and access or modify critical data across the scope, including resources outside VirtualBox itself. The flaw is rated CVSS 3.1 7.5 with a scope change, but exploitation is rated High complexity by Oracle and there is no public exploit identified at time of analysis. Patch is available per Oracle's June 2026 Critical Patch Update advisory.
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker who is already logged onto the host running VirtualBox to take over the VirtualBox instance, with a scope change that can significantly impact additional products beyond the hypervisor itself. The flaw is classed as improper access control (CWE-284) and tagged as an authentication bypass, yielding total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and EPSS is negligible (0.01%), consistent with the high attack complexity and privilege requirements.
Partial denial-of-service in Oracle VM VirtualBox 7.2.6 Core component allows a locally authenticated, high-privileged attacker to degrade availability of the hypervisor. Exploitation is limited to the local system and requires pre-existing administrative-level access, with no confidentiality or integrity impact. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog; EPSS at 0.01% (2nd percentile) reflects near-zero exploitation probability.
Improper access control in Oracle VM VirtualBox 7.2.6's Core component allows a high-privileged local attacker with logon access to the host infrastructure to perform unauthorized writes, inserts, or deletions against VirtualBox-accessible data. Notably, Oracle's advisory confirms a scope change - successful exploitation may affect additional products beyond VirtualBox itself, such as guest VM environments sharing the same host. No active exploitation is confirmed (SSVC: none; EPSS: 0.01%, 2nd percentile), and no public exploit or POC has been identified at time of analysis.
Oracle VM VirtualBox 7.2.6 contains an improper access control flaw in its Core component that enables a highly privileged local attacker to partially compromise confidentiality, integrity, and availability - with a scope change indicating potential bleed beyond the VirtualBox process boundary to adjacent products or guest VMs on the same host. Exploitation requires local logon with high privileges and high attack complexity, making opportunistic exploitation unlikely; EPSS at the 2nd percentile and SSVC exploitation status of 'none' corroborate low real-world risk. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog.
Confidentiality breach in Oracle VM VirtualBox 7.2.6 Core allows a high-privileged local attacker to gain complete read access to all data accessible by the VirtualBox process, with scope change indicating potential data leakage beyond the primary VM boundary into adjacent virtualized environments. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:C) confirms local-only exploitation requiring administrative-level host access, substantially limiting the realistic attacker pool. No active exploitation is confirmed - EPSS sits at 0.01% (2nd percentile), SSVC rates exploitation as none, and the vulnerability is absent from CISA KEV.
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker with logon access to the host to take over VirtualBox, with a scope change that can significantly impact additional products beyond the hypervisor itself. Disclosed in Oracle's April 2026 Critical Patch Update with a CVSS 3.1 base score of 7.5 and full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none with the flaw rated not automatable.
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over the VirtualBox Remote Desktop Protocol (VRDP/RDP) service trigger a hang or repeatable crash, producing a complete availability loss of the virtualization host process. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 12th percentile), so while the flaw is network-reachable and unauthenticated, real-world exploitation pressure currently appears minimal. Note that the supplied 'Authentication Bypass' tag conflicts with the availability-only CVSS vector - the confirmed impact is DoS, not auth bypass.
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can log on to the host where VirtualBox runs, per Oracle's April 2026 Critical Patch Update. Because the flaw carries a scope change (S:C), a successful attack breaks out of VirtualBox and can significantly impact additional products on the host, yielding total loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with the high exploitation difficulty (AC:H) and the local, high-privilege prerequisite.
Guest-to-host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker to take over the VirtualBox instance, with a scope change that can significantly impact products beyond VirtualBox itself - consistent with a hypervisor escape affecting the host. Disclosed in the Oracle April 2026 Critical Patch Update with a CVSS 3.1 base score of 7.5. There is no public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.01%).
Oracle VM VirtualBox 7.2.12 contains a Core component vulnerability exploitable by high-privileged local attackers that produces a scope change, potentially compromising systems beyond VirtualBox itself. Successful exploitation yields complete confidentiality loss of all VirtualBox-accessible data and a partial denial of service, making this an isolation-breach risk in multi-tenant or shared virtualization environments. No public exploit identified at time of analysis, and the AC:H rating signals difficult exploitation, but the scope change (S:C) elevates real-world concern for environments where VirtualBox hosts sensitive guest workloads.
Oracle VM VirtualBox 7.2.12 on the host infrastructure is vulnerable to a local denial-of-service and limited data integrity attack requiring human interaction from a third party. An attacker with logon access to the host - but no specific privileges on VirtualBox - can trigger a complete hang or repeated crash of the hypervisor, plus unauthorized modification of a subset of accessible VM data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low complexity and no-privileges-required local vector make this straightforward to execute once host access is obtained.
Oracle VM VirtualBox 7.2.12 Core component exposes a local information disclosure path that allows a high-privileged host-level attacker to read a subset of VirtualBox-accessible data, with scope change indicating that impact can extend beyond the hypervisor process itself to adjacent resources such as guest VMs. The vulnerability is rated CVSS 3.2 (Low) and is confirmed by Oracle's July 2026 Critical Patch Update; no public exploit code and no CISA KEV listing exist. The combination of local-only access and mandatory high privileges severely constrains real-world exploitability, making this a low-priority finding for most organizations outside multi-tenant or shared-host VirtualBox deployments.
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is already logged into the infrastructure running VirtualBox to compromise the hypervisor, with a scope change (CVSS S:C) indicating impact beyond VirtualBox itself - consistent with a guest-to-host or component-crossing escape. Oracle rates it CVSS 3.1 7.5 with full confidentiality, integrity, and availability impact, though exploitation is difficult (AC:H, PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle VM VirtualBox 7.2.12 Core component allows a low-privileged local attacker, under high-complexity conditions, to break VM isolation boundaries and compromise data integrity of the hypervisor and potentially adjacent systems. Successful exploitation can result in unauthorized creation, deletion, or modification of critical VirtualBox-accessible data, along with partial denial of service. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis, but the scope change (S:C) elevates priority in multi-tenant or shared-host VirtualBox deployments where VM boundary integrity is a security guarantee.
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attacker with a logon to the host take over the VirtualBox hypervisor and, because of a scope change, impact additional products beyond VirtualBox itself. The flaw carries full confidentiality, integrity, and availability impact but is rated difficult to exploit, requiring high privileges and high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged attacker with a local logon on the host where VirtualBox executes to take over the VirtualBox installation, with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV; despite a vendor 'Information Disclosure' tag, the CVSS vector reports full C/I/A impact consistent with product takeover. Exploitation requires prior local access and low privileges, which limits mass exploitation but makes it valuable as a post-access escalation step.
Oracle VM VirtualBox 7.2.12 Core component allows a low-privileged local user to repeatedly crash or hang the hypervisor, causing a complete denial of service against all guest virtual machines running on the affected host. This vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified at time of analysis. The practical blast radius is limited to shared-access VirtualBox hosts where untrusted or semi-trusted local accounts exist, which is more common in developer workstations than hardened production environments.
Oracle VM VirtualBox 7.2.12 Core component contains a local integrity vulnerability enabling a highly privileged attacker with host logon access to make unauthorized modifications to VirtualBox-accessible data, with potential cross-boundary impact on additional products due to scope change (S:C). The constraint to local, high-privilege access (AV:L/PR:H) limits the realistic threat surface to insider threats or post-compromise scenarios on hypervisor hosts. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged attacker who can log on to the host to compromise the VirtualBox Core component with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The single vendor reference is Oracle's July 2026 Critical Patch Update advisory.
Local exploitation of the Core component in Oracle VM VirtualBox 7.2.12 allows a low-privileged attacker to perform unauthorized creation, deletion, or modification of critical VirtualBox data and cause a partial denial of service - provided a second user's interaction can be induced. Oracle disclosed this in the July 2026 Critical Patch Update (CPU), classifying it as easily exploitable under those local conditions. No public exploit code or active exploitation has been identified at time of analysis, and the mandatory human-interaction requirement (UI:R) materially constrains unassisted or automated attacks.
Integrity and availability compromise in Oracle VM VirtualBox 7.2.8 (Core component) allows a high-privileged local user, with the aid of a separate tricked user, to modify or destroy critical data and force a complete denial of service, with impact crossing into additional products due to a scope change. Rated CVSS 3.1 7.4 and disclosed in Oracle's July 2026 Critical Patch Update, it carries no confidentiality impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged attacker with a logon session on the host where VirtualBox runs to fully compromise the VirtualBox instance, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. It was disclosed by Oracle in the July 2026 Critical Patch Update.
Local denial-of-service in Oracle VM VirtualBox 7.2.12 allows a low-privileged attacker with local logon access to the host system to repeatedly crash or hang the VirtualBox process, rendering the hypervisor unavailable. The flaw resides in the Core component and requires no user interaction once the attacker has a local session on the infrastructure host. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to availability - confidentiality and integrity are unaffected.
Local privilege abuse in Oracle VM VirtualBox 7.2.12 Core component permits a high-privileged local attacker to read a subset of VirtualBox-accessible data, with confirmed scope change indicating potential exposure of data belonging to co-hosted or adjacent products. The CVSS score of 3.2 (Low) reflects the constrained attack surface - requiring local logon with high privileges - but the scope change flag (S:C) elevates the architectural concern, as information disclosed may originate outside the directly compromised VirtualBox instance. No public exploit code or active exploitation has been identified at time of analysis.
Oracle VM VirtualBox 7.2.12 Core component allows a high-privileged local attacker to cause a complete denial-of-service by crashing or hanging the hypervisor, with a scope change indicating the impact can extend beyond the primary VirtualBox process to affect additional products on the same infrastructure. The vulnerability is confirmed by Oracle's July 2026 Critical Patch Update. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized read access in Oracle VM VirtualBox 7.2.8's VMSVGA device component can be triggered by a locally authenticated, highly privileged attacker, resulting in a scope-change impact that may expose a subset of confidential data from resources beyond the guest VM boundary, potentially the host layer. Oracle's June 2026 Critical Patch Update describes the flaw as easily exploitable once the high-privilege prerequisite is met, though the constrained attack surface limits realistic exposure to administrative accounts with existing local host access. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; the low CVSS base score of 3.2 reflects the narrow confidentiality-only impact and strict access requirements.
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high privileges to take over the VirtualBox installation and cross the hypervisor boundary into additional products (scope-changed). Oracle's CPU advisory rates this CVSS 3.1 7.5 with high attack complexity; no public exploit identified at time of analysis and it is not listed in CISA KEV.
The VMSVGA virtual graphics device in Oracle VM VirtualBox 7.2.8 allows a high-privileged local attacker to cross the guest-to-host isolation boundary and gain unauthorized read access to critical data beyond the VM's intended scope. The CVSS scope change (S:C) confirms this is a hypervisor boundary violation - successful exploitation exposes host-level or cross-VM confidential data, a severe outcome in multi-tenant virtualization environments despite the moderate base score. No public exploit identified at time of analysis, and no CISA KEV listing indicates no confirmed active exploitation.
Oracle VM VirtualBox 7.2.8 Core component exposes a local information disclosure path exploitable by a high-privileged attacker already logged on to the host infrastructure, resulting in unauthorized read access to a subset of VirtualBox-accessible data. The CVSS scope change (S:C) indicates the read impact may cross virtualization boundaries and affect additional products - such as guest VMs - beyond the VirtualBox process itself. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, placing this in a low-urgency but operationally meaningful category for multi-tenant virtualization environments.
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a high-privileged local attacker to break out of the virtualization boundary and impact additional products beyond VirtualBox itself (scope change). The flaw carries a CVSS 3.1 base score of 7.5 with full confidentiality, integrity, and availability impact, but exploitation is rated high complexity. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Integrity compromise in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device component allows a highly privileged local attacker to make unauthorized modifications to critical data, with scope change indicating impact extends beyond the initially targeted VM instance. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N) confirms local-only attack surface requiring high privileges, but the confirmed scope change elevates the potential blast radius to the host or adjacent VMs. No public exploit has been identified at time of analysis, and the vulnerability is patched under Oracle's Critical Security Update for June 2026.
Local information disclosure in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a high-privileged guest or host attacker to read a subset of VirtualBox-accessible data across the VM isolation boundary. The scope change (S:C) in the CVSS vector indicates the vulnerability crosses the hypervisor boundary, making it relevant to multi-tenant or shared virtualization deployments despite the low base score of 3.2. No public exploit has been identified and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog; Oracle addressed it in the June 2026 Critical Patch Update.
Information disclosure in the VMSVGA device component of Oracle VM VirtualBox 7.2.8 enables a highly privileged local attacker already present on the virtualization host to read a subset of VirtualBox-accessible data. The scope change (S:C) in the CVSS vector is the most operationally significant element - exploitation can impact components beyond the VirtualBox process itself, potentially reaching adjacent VMs or host resources. No public exploit code and no active exploitation have been identified at time of analysis; CVSS base score of 3.2 (Low) reflects limited confidentiality impact and a high privilege bar.
Denial-of-service in Oracle VM VirtualBox 7.2.8 affects the VMSVGA virtual graphics device emulation layer, allowing a highly privileged local attacker to cause a persistent hang or fully repeatable crash of the hypervisor process. The CVSS Scope:Changed metric signals that the DoS impact propagates beyond the attacker's own guest VM, potentially destabilizing the host process and all co-resident VMs - a meaningful concern in multi-tenant and VDI environments. No public exploit code exists and no CISA KEV listing is present at time of analysis; exploitation is bounded by the requirement for high-privileged local access to the infrastructure.
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privileged local attacker on the host to escape the guest/host boundary and access or modify critical data across the scope, including resources outside VirtualBox itself. The flaw is rated CVSS 3.1 7.5 with a scope change, but exploitation is rated High complexity by Oracle and there is no public exploit identified at time of analysis. Patch is available per Oracle's June 2026 Critical Patch Update advisory.
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker who is already logged onto the host running VirtualBox to take over the VirtualBox instance, with a scope change that can significantly impact additional products beyond the hypervisor itself. The flaw is classed as improper access control (CWE-284) and tagged as an authentication bypass, yielding total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and EPSS is negligible (0.01%), consistent with the high attack complexity and privilege requirements.
Partial denial-of-service in Oracle VM VirtualBox 7.2.6 Core component allows a locally authenticated, high-privileged attacker to degrade availability of the hypervisor. Exploitation is limited to the local system and requires pre-existing administrative-level access, with no confidentiality or integrity impact. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog; EPSS at 0.01% (2nd percentile) reflects near-zero exploitation probability.
Improper access control in Oracle VM VirtualBox 7.2.6's Core component allows a high-privileged local attacker with logon access to the host infrastructure to perform unauthorized writes, inserts, or deletions against VirtualBox-accessible data. Notably, Oracle's advisory confirms a scope change - successful exploitation may affect additional products beyond VirtualBox itself, such as guest VM environments sharing the same host. No active exploitation is confirmed (SSVC: none; EPSS: 0.01%, 2nd percentile), and no public exploit or POC has been identified at time of analysis.
Oracle VM VirtualBox 7.2.6 contains an improper access control flaw in its Core component that enables a highly privileged local attacker to partially compromise confidentiality, integrity, and availability - with a scope change indicating potential bleed beyond the VirtualBox process boundary to adjacent products or guest VMs on the same host. Exploitation requires local logon with high privileges and high attack complexity, making opportunistic exploitation unlikely; EPSS at the 2nd percentile and SSVC exploitation status of 'none' corroborate low real-world risk. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog.
Confidentiality breach in Oracle VM VirtualBox 7.2.6 Core allows a high-privileged local attacker to gain complete read access to all data accessible by the VirtualBox process, with scope change indicating potential data leakage beyond the primary VM boundary into adjacent virtualized environments. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:C) confirms local-only exploitation requiring administrative-level host access, substantially limiting the realistic attacker pool. No active exploitation is confirmed - EPSS sits at 0.01% (2nd percentile), SSVC rates exploitation as none, and the vulnerability is absent from CISA KEV.
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker with logon access to the host to take over VirtualBox, with a scope change that can significantly impact additional products beyond the hypervisor itself. Disclosed in Oracle's April 2026 Critical Patch Update with a CVSS 3.1 base score of 7.5 and full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none with the flaw rated not automatable.
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over the VirtualBox Remote Desktop Protocol (VRDP/RDP) service trigger a hang or repeatable crash, producing a complete availability loss of the virtualization host process. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 12th percentile), so while the flaw is network-reachable and unauthenticated, real-world exploitation pressure currently appears minimal. Note that the supplied 'Authentication Bypass' tag conflicts with the availability-only CVSS vector - the confirmed impact is DoS, not auth bypass.
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can log on to the host where VirtualBox runs, per Oracle's April 2026 Critical Patch Update. Because the flaw carries a scope change (S:C), a successful attack breaks out of VirtualBox and can significantly impact additional products on the host, yielding total loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with the high exploitation difficulty (AC:H) and the local, high-privilege prerequisite.
Guest-to-host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker to take over the VirtualBox instance, with a scope change that can significantly impact products beyond VirtualBox itself - consistent with a hypervisor escape affecting the host. Disclosed in the Oracle April 2026 Critical Patch Update with a CVSS 3.1 base score of 7.5. There is no public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.01%).