CVE-2026-35249
Privilege Escalation in Oracle VM VirtualBox 7.2.6 Core Component
Publication date: 2026-04-21
Last updated on: 2026-04-23
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | vm_virtualbox | 7.2.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle VM VirtualBox product, specifically in its core component. It affects version 7.2.6 and can be exploited by a highly privileged attacker who already has logon access to the infrastructure where Oracle VM VirtualBox runs. The attacker can compromise Oracle VM VirtualBox, potentially impacting other related products as well. The vulnerability allows unauthorized update, insertion, or deletion of some data accessible by Oracle VM VirtualBox.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow a high privileged attacker to modify data within Oracle VM VirtualBox without authorization. This means the attacker could update, insert, or delete data, potentially leading to data integrity issues. Since the scope of the attack can extend beyond Oracle VM VirtualBox to other products, the impact could be broader, affecting the stability and trustworthiness of the virtualized environment.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a high privileged attacker with logon access to compromise Oracle VM VirtualBox, potentially leading to unauthorized update, insert, or delete access to some accessible data.
Such unauthorized data modifications could impact the integrity of data, which is a critical aspect of compliance with standards like GDPR and HIPAA that require protection of data integrity and prevention of unauthorized access or alteration.
However, the CVE description does not explicitly mention compliance implications or specific effects on regulatory requirements.