CVE-2026-35242
Privilege Escalation in Oracle VM VirtualBox 7.2.6 Leads to Full Compromise
Publication date: 2026-04-21
Last updated on: 2026-04-23
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | vm_virtualbox | 7.2.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle VM VirtualBox product, specifically in its core component. It affects version 7.2.6 and is difficult to exploit. However, a high privileged attacker who already has logon access to the infrastructure where Oracle VM VirtualBox runs can exploit this vulnerability to compromise the VirtualBox software.
Successful exploitation can lead to a complete takeover of Oracle VM VirtualBox, potentially impacting other related products as well.
How can this vulnerability impact me? :
If exploited, this vulnerability can result in a full compromise of Oracle VM VirtualBox, allowing an attacker to gain control over the virtualization environment.
The impacts include loss of confidentiality, integrity, and availability of the affected system, which means sensitive data could be exposed or altered, and services could be disrupted.
Because the scope of the attack can extend beyond Oracle VM VirtualBox itself, other products relying on it may also be affected.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Oracle VM VirtualBox allows a high privileged attacker to compromise the system, potentially leading to a takeover of Oracle VM VirtualBox with impacts on confidentiality, integrity, and availability.
Such a compromise could affect compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity. However, the provided information does not explicitly describe the direct impact on compliance with these regulations.