CVE-2026-35230
Privilege Escalation in Oracle VM VirtualBox 7.2.6 Leads to Full Compromise
Publication date: 2026-04-21
Last updated on: 2026-04-23
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | vm_virtualbox | 7.2.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle VM VirtualBox product, specifically in its core component. It affects version 7.2.6 and is difficult to exploit. However, if a highly privileged attacker who already has logon access to the infrastructure where Oracle VM VirtualBox runs exploits it successfully, they can compromise the Oracle VM VirtualBox software.
The vulnerability can lead to a takeover of Oracle VM VirtualBox, and because of a scope change, attacks may also significantly impact additional products beyond VirtualBox itself.
How can this vulnerability impact me? :
Successful exploitation of this vulnerability can result in a complete takeover of Oracle VM VirtualBox. This means an attacker could gain control over the virtualization environment, potentially compromising confidentiality, integrity, and availability of the system and any virtual machines running on it.
- Confidentiality impact: sensitive data could be exposed.
- Integrity impact: attacker could alter data or system state.
- Availability impact: attacker could disrupt or deny access to services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows a high privileged attacker to compromise Oracle VM VirtualBox, potentially resulting in a takeover of the product with impacts on confidentiality, integrity, and availability.
Such a compromise could lead to unauthorized access or manipulation of sensitive data, which may affect compliance with standards and regulations like GDPR and HIPAA that require protection of data confidentiality and integrity.
However, the provided information does not explicitly describe the direct impact on compliance with these regulations.