CVE-2026-35248
Privilege Escalation in Oracle VM VirtualBox 7.2.6 Core Component
Publication date: 2026-04-21
Last updated on: 2026-04-23
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | vm_virtualbox | 7.2.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle VM VirtualBox product, specifically in version 7.2.6. It is a difficult to exploit flaw that allows a highly privileged attacker who already has logon access to the infrastructure running Oracle VM VirtualBox to compromise the product.
Successful exploitation can lead to unauthorized update, insertion, or deletion of some data accessible by Oracle VM VirtualBox, unauthorized reading of some data, and the ability to cause a partial denial of service (partial DOS) affecting Oracle VM VirtualBox.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with high privileges to modify, delete, or insert data within Oracle VM VirtualBox, read sensitive data without authorization, and cause a partial denial of service, potentially disrupting services.
Because the scope of the attack may extend beyond Oracle VM VirtualBox itself, other products relying on it could also be significantly impacted.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a high privileged attacker with logon access to compromise Oracle VM VirtualBox, potentially leading to unauthorized read, update, insert, or delete access to data accessible by Oracle VM VirtualBox, as well as partial denial of service.
Such unauthorized access and data manipulation could impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding the confidentiality, integrity, and availability of sensitive data.
However, the provided information does not explicitly describe the direct effects on compliance with these standards.