In Oracle VirtualBox version 7.2.6, a difficult‑to‑exploit flaw allows a local attacker who already has high privileges to compromise the VirtualBox process, granting full control over the virtualization host and potentially any virtual machines it manages. The identified weakness can affect confidentiality, integrity, and availability, and the scope change indicates that compromise of VirtualBox may propagate to additional products that rely on the virtualization stack.

The affected product is Oracle Corporation’s Oracle VM VirtualBox, specifically version 7.2.6. Any host running this version is vulnerable to the described local privilege escalation and subsequent takeover.

The CVSS vector shows a local attack surface, high privilege account, no user interaction, and a scope change, yielding a Base Score of 7.5. No public exploit is known and the EPSS score is unavailable, but an attacker who can log on to the host as a privileged user could leverage this flaw. The vulnerability is not listed in CISA’s KEV catalog, suggesting limited evidence of active exploitation, yet the potential impact on systems that run VirtualBox remains significant.