CVE-2026-35230 is a vulnerability in the core component of Oracle VM VirtualBox version 7.2.6. It requires a high privileged attacker with local access (logon) to the infrastructure where VirtualBox runs. The vulnerability is difficult to exploit and can lead to a complete compromise of Oracle VM VirtualBox, impacting confidentiality, integrity, and availability. The vulnerability has a scope change, meaning it may affect other Oracle products beyond VirtualBox. The CVSS 3.1 vector indicates local attack vector, high attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The vendor advisory from Oracle's April 2026 Critical Patch Update does not explicitly mention a patch for this vulnerability but strongly recommends applying updates promptly for all affected products.

Successful exploitation allows a high privileged attacker with local access to take over Oracle VM VirtualBox, potentially leading to full compromise of the virtualization environment. This can affect confidentiality, integrity, and availability of the affected system. Due to scope change, other Oracle products integrated or dependent on VirtualBox may also be impacted. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a patch is available, limit access to systems running Oracle VM VirtualBox to trusted, high privileged users only, and monitor for unusual activity. Follow Oracle's security best practices for privileged access management.