Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.0",
  "pubDate": "2026-08-18T21:18:11.993Z",
  "pubdate": "2026-08-18T21:18:11.993Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Core component of Oracle VM VirtualBox version 7.2.14, allowing a highly privileged local attacker to compromise the virtualization software.\nThe vulnerability is characterized by a high-privilege attack vector requiring local logon access to the underlying infrastructure where Oracle VM VirtualBox executes, with zero user interaction required for successful exploitation.\nAlthough the flaw resides directly within Oracle VM VirtualBox, the architectural impact includes a scope change, meaning that successful exploitation can extend beyond the immediate boundaries of the virtualization product to significantly impact additional associated systems and resources.\nThe primary security impact is focused on confidentiality, resulting in unauthorized access to critical data or complete access to all data accessible via Oracle VM VirtualBox.\nWith a CVSS 3.1 Base Score of 6.0 and a vector of CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, the risk implications highlight the necessity of strict local privilege management and infrastructure hardening to prevent malicious actors who have attained high privileges from harvesting sensitive virtualized data.",
  "technicalDetails": "The vulnerability resides in the Core component of Oracle VM VirtualBox, specifically affecting version 7.2.14.\nExploitation of this vulnerability requires local access, meaning the attacker must already possess the capability to log on to the host infrastructure where the Oracle VM VirtualBox software executes.\nThe attack complexity is low (AC:L), and the required privileges are high (PR:H), dictating that an adversary must first escalate or acquire elevated administrative or root-level privileges on the host system before attempting to leverage this flaw.\nNo user interaction (UI:N) is necessary for the attack to succeed, allowing automated or direct execution by the privileged adversary.\nA notable characteristic of this vulnerability is the security scope change (S:C), indicating that the compromise extends beyond the security authority domain of the Oracle VM VirtualBox Core component, potentially affecting peripheral infrastructure or adjacent products managed within the environment.\nThe step-by-step attack flow begins with the threat actor establishing a high-privileged logon session on the infrastructure hosting the target Oracle VM VirtualBox instance.\nLeveraging their elevated administrative standing, the attacker interacts with the vulnerable Core component of Oracle VM VirtualBox, bypassing internal isolation boundaries or access controls due to flaws in how the core processes handle privileged local requests.\nUpon successful execution of the exploit payload, the attacker achieves unauthorized read access to sensitive assets.\nThe post-exploitation impact is strictly confined to confidentiality (C:H), resulting in either unauthorized access to critical data or complete extraction of all data accessible through the Oracle VM VirtualBox ecosystem, while integrity and availability remain unaffected (I:N, A:N)."
}