CVE-2026-35275: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Shared Folders)

Synopsis

This is a privilege-escalation or data-access vulnerability in the Shared Folders component of Oracle VM VirtualBox 7.2.8. An attacker must already have a low-privileged local account on the host where VirtualBox runs, and exploitation is difficult due to environmental conditions that must be met. Successful exploitation gives the attacker full read and write access to critical data inside the VirtualBox environment, with scope extending beyond the hypervisor itself to other products or tenants on the same host. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege local account on the host is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No user interaction is required; the attacker can act entirely on their own.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must meet specific environmental conditions or timing constraints beyond their direct control.

Blast Radius

• Reads all data accessible to Oracle VM VirtualBox, including files in shared folders exposed to guest virtual machines.
• Modifies or deletes critical data inside the VirtualBox environment, including shared folder contents and configuration.
• The scope change means impact extends beyond VirtualBox itself, so other products or isolation boundaries co-located on the same host can be affected.