CVE-2026-35248: 
VirtualBox vulnerability analysis and mitigation

CVE-2026-35248 is an Improper Access Control (CWE-284) vulnerability in the Core component of Oracle VM VirtualBox version 7.2.6. It was disclosed on April 21, 2026, as part of Oracle's April 2026 Critical Patch Update (CPUapr2026) and was reported by security researcher Aaron Esau. The vulnerability carries a CVSS v3.1 base score of 5.0 (Medium), reflecting its local attack vector, high attack complexity, and requirement for high privileges (Oracle Advisory, GitHub Advisory).

The vulnerability is classified as CWE-284 (Improper Access Control) and resides in the Core component of Oracle VM VirtualBox 7.2.6. Exploitation requires a high-privileged attacker with local logon access to the infrastructure where VirtualBox executes, and the attack complexity is rated High, indicating that specific conditions must be met for successful exploitation. Notably, the vulnerability has a scope change, meaning a successful attack may impact components or products beyond VirtualBox itself — potentially affecting the host system or other guest VMs. No specific technical write-ups or proof-of-concept code have been publicly disclosed (Oracle Advisory, GitHub Advisory).

Successful exploitation allows a high-privileged local attacker to perform unauthorized read access to a subset of VirtualBox-accessible data, unauthorized modification (insert, update, or delete) of VirtualBox data, and cause a partial denial of service of VirtualBox. The scope change means the impact may extend beyond the VirtualBox hypervisor itself to additional products or components on the same infrastructure, raising the potential for lateral movement or host-level data exposure in multi-tenant or shared virtualization environments (Oracle Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.012–0.017%, placing it in a very low percentile for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high privilege requirement and high attack complexity significantly limit the practical exploitability of this vulnerability (GitHub Advisory, Feedly).

Oracle has addressed this vulnerability in the April 2026 Critical Patch Update (CPUapr2026). Users running Oracle VM VirtualBox 7.2.6 should apply the available security patches immediately. As interim measures, Oracle recommends restricting administrative and local logon access to infrastructure where VirtualBox is deployed, and monitoring for unauthorized access attempts by high-privileged users. Oracle strongly advises against relying on workarounds as a long-term solution (Oracle Advisory).