CVE-2026-35246
Privilege Escalation in Oracle VM VirtualBox 7.2.6 Leads to Full Compromise
Publication date: 2026-04-21
Last updated on: 2026-04-23
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | vm_virtualbox | 7.2.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle VM VirtualBox product, specifically in its core component. It affects version 7.2.6 and is difficult to exploit. However, if a high privileged attacker who already has logon access to the infrastructure where Oracle VM VirtualBox runs exploits it successfully, they can compromise Oracle VM VirtualBox.
The vulnerability allows an attacker to take over Oracle VM VirtualBox, potentially impacting other products as well due to a scope change.
How can this vulnerability impact me? :
Successful exploitation of this vulnerability can lead to a complete takeover of Oracle VM VirtualBox by an attacker with high privileges.
This takeover can impact confidentiality, integrity, and availability of the affected system, as indicated by the CVSS score of 7.5 with high impacts on these security aspects.
Additionally, because the scope of the attack may extend beyond Oracle VM VirtualBox, other products running in the same environment could also be affected.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows a high privileged attacker to compromise Oracle VM VirtualBox, potentially leading to a takeover of the product with impacts on confidentiality, integrity, and availability.
Such a compromise could affect compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity, but specific impacts or compliance implications are not detailed in the provided information.