{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35247", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2026-04-01T20:03:40.833Z", "datePublished": "2026-04-21T20:35:52.043Z", "dateUpdated": "2026-04-21T20:35:52.043Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-04-21T20:35:52.043Z"}, "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data."}]}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle VM VirtualBox", "versions": [{"version": "7.2.6", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:oracle:vm_virtualbox:7.2.6:*:*:*:*:*:*:*"}]}]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N)."}], "references": [{"url": "https://www.oracle.com/security-alerts/cpuapr2026.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "baseScore": 6, "baseSeverity": "MEDIUM"}}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N)."}], "id": "CVE-2026-35247", "lastModified": "2026-04-21T21:16:40.817", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 4.0, "source": "secalert_us@oracle.com", "type": "Primary"}]}, "published": "2026-04-21T21:16:40.817", "references": [{"source": "secalert_us@oracle.com", "url": "https://www.oracle.com/security-alerts/cpuapr2026.html"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.6"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Oracle VM VirtualBox", "source": "cna", "vendor": "Oracle Corporation"}, "product": "vm_virtualbox", "vendor": "oracle"}], "analysis": {"en": {"generated_at": "2026-04-22T04:43:20.848872+00:00", "value": {"mitigation_remediation": ["Upgrade Oracle VM VirtualBox to a non\u2011affected version that includes the vendor patch for this vulnerability.", "Restrict local host access to only trusted administrators and enforce least privilege on any accounts that can log into the VirtualBox host.", "Implement network segmentation or virtual isolation so that the VirtualBox environment does not have direct access to sensitive host or network resources.", "Regularly audit VirtualBox configurations and monitor logs for any unauthorized access attempts or configuration changes."], "summary": {"action": "Patch Now", "impact": "Unauthorized access to critical data"}, "threat_synthesis": {"affected_systems": "Affected systems include Oracle Corporation's Oracle VM VirtualBox version 7.2.6. No other product or version has been identified as impacted in the current advisory.", "description_and_impact": "The vulnerability resides in the core component of Oracle VM VirtualBox 7.2.6 and permits an attacker with local host credentials to gain unauthorized access to the VirtualBox installation. This flaw can lead to confidentiality compromise of all data accessible through VirtualBox, including the contents of virtual machine images and host\u2011side configuration files. The defect represents an improper access control issue that allows privileged local users to subvert access restrictions imposed by VirtualBox.", "risk_and_exploitability": "The CVSS v3.1 base score of 6.0 indicates a medium severity, with local access and low authentication complexity reducing the barrier for exploitation. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. The described local attack vector requires an attacker to have logon to the host system and privileged credentials, and the impact is scoped to the VirtualBox environment, potentially affecting additional connected products due to the change in scope. Because the exploit relies on local privileges, the risk remains high for environments where the host is not properly secured or where critical data resides within virtual machines."}}}}, "created": "2026-04-22T02:45:05.723589+00:00", "title": "Oracle VM VirtualBox 7.2.6 Local Privilege Escalation", "updated": "2026-04-22T04:45:09.354051+00:00", "vendors": ["oracle", "oracle$PRODUCT$vm_virtualbox"], "weaknesses": ["CWE-284", "CWE-285"]}