The vulnerability in Oracle VM VirtualBox 7.2.6 permits a high‑privileged attacker who already has logon access to the host infrastructure to compromise the VirtualBox host itself. Exploitation allows the attacker to perform unauthorized updates, inserts, or deletions on data the VirtualBox service manages, to read restricted data subsets, and to induce a partial denial of service. The impact spans confidentiality, integrity, and availability, and the scope change indicates that the security failure could propagate to other Oracle products that interact with VirtualBox.

Oracle Corporation’s Oracle VM VirtualBox, version 7.2.6. The affected component is the Core module of the VirtualBox application.

The CVSS 3.1 base score of 5.0 denotes moderate severity, with low attacker–required efforts (attack vector LOCAL, high privilege), no user interaction, and a scope change. EPSS is not available and the vulnerability is not listed in CISA KEV. An attacker must already be logged in with elevated privileges on the host; from that position the flaw can be exploited to obtain partial data access and to disrupt functionality of VirtualBox. Because the scope changes, additional Oracle products may also be impacted indirectly.