CVE-2026-46974: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)

Synopsis

A privilege escalation and full-compromise vulnerability exists in the Core component of Oracle VM VirtualBox 7.2.8. Exploitation requires an attacker who already holds a high-privileged (admin-level) account and local logon access to the host where VirtualBox runs, with additional environmental conditions making reliable exploitation difficult. Successful exploitation gives the attacker complete control over the VirtualBox instance, with impact that can extend beyond the hypervisor to affect other products running on the same infrastructure. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-exposed attack surface is required.

• AuthenticationRequired

  A high-privileged (administrator-level) account on the infrastructure host is required before the attack can proceed.

• Victim interactionNot required

  No victim interaction is needed; the attacker proceeds without involving another user.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must meet specific environmental conditions or timing constraints beyond simply having credentials and access.

Blast Radius

• A successful attacker gains full read access to all data inside the VirtualBox instance, including guest VM memory, virtual disk contents, and configuration secrets.
• The attacker can modify or corrupt VirtualBox state, guest filesystems, or persisted virtual machine configurations.
• The attacker can crash or hang VirtualBox and any guest VMs it is running, causing a full service outage for hosted workloads.
• Because the CVSS vector marks a scope change, compromise can spill beyond VirtualBox itself and affect other products or processes sharing the same host infrastructure.