CVE-2026-35251: 
VirtualBox vulnerability analysis and mitigation

CVE-2026-35251 is an Improper Access Control (CWE-284) vulnerability in the Core component of Oracle VM VirtualBox, classified as an Elevation of Privilege issue. The affected version is Oracle VM VirtualBox 7.2.6. It was disclosed on April 21, 2026, as part of Oracle's Critical Patch Update (CPU) for April 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Oracle CPU Apr 2026, Github Advisory). The vulnerability was reported to Oracle by Bartosz Michałowski, Jan Kamiński, and Kamil Frankowicz (Oracle CPU Apr 2026).

The vulnerability is rooted in Improper Access Control (CWE-284) within the Core component of Oracle VM VirtualBox 7.2.6. Exploitation requires a high-privileged attacker with local logon access to the infrastructure where VirtualBox executes, and the attack complexity is rated High, indicating that specific conditions must be met for successful exploitation. A notable characteristic is the scope change (S:C), meaning a successful attack can impact resources beyond the VirtualBox hypervisor itself — potentially affecting guest virtual machines or other co-located systems. No public proof-of-concept or detailed technical write-up describing the specific exploitation mechanics has been identified (Oracle CPU Apr 2026, Github Advisory).

Successful exploitation of CVE-2026-35251 can result in a complete takeover of Oracle VM VirtualBox, with high impacts to confidentiality, integrity, and availability. Because the vulnerability involves a scope change, the compromise is not limited to VirtualBox itself — guest virtual machines and other products managed by the hypervisor may also be affected. This could enable an attacker to access sensitive data within VMs, disrupt VM availability, or manipulate VM configurations, potentially facilitating lateral movement within a virtualized infrastructure (Oracle CPU Apr 2026, Github Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported as of the time of disclosure (Github Advisory). The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for high privileges and local access, as well as high attack complexity.

Oracle has addressed this vulnerability as part of the April 2026 Critical Patch Update. Users should upgrade Oracle VM VirtualBox beyond version 7.2.6 to a patched release provided by Oracle. As interim measures, organizations should restrict local logon access to systems running VirtualBox to only trusted administrators, and implement host-level access controls to minimize the attack surface. Oracle strongly recommends applying CPU patches without delay rather than relying on workarounds (Oracle CPU Apr 2026, Github Advisory).

The vulnerability received standard coverage from vulnerability tracking platforms and security feeds shortly after Oracle's April 2026 CPU release, including mentions on Mastodon security accounts and aggregation by Kaspersky Threats and Tenable. No notable researcher commentary or significant community debate has been identified beyond routine disclosure tracking.