CVE-2026-35248 affects Oracle VM VirtualBox 7.2.6 and is a difficult to exploit vulnerability requiring high privileges and local access. It allows an attacker to compromise VirtualBox, resulting in unauthorized modification and reading of accessible data and partial denial of service. The vulnerability has a CVSS 3.1 score of 5.0 with attack vector local, high attack complexity, high privileges required, no user interaction, and scope change. Oracle's April 2026 Critical Patch Update advisory mentions many patches but does not explicitly state a fix for this vulnerability. The advisory emphasizes the importance of applying patches promptly to mitigate known vulnerabilities.

An attacker with high privileges and local access to the infrastructure running Oracle VM VirtualBox 7.2.6 can exploit this vulnerability to gain unauthorized read and write access to some VirtualBox accessible data and cause a partial denial of service. The vulnerability's scope change means it may affect additional products beyond VirtualBox. The impact on confidentiality, integrity, and availability is limited but non-negligible. There are no known exploits in the wild at this time.

Oracle's advisory does not explicitly confirm a patch for CVE-2026-35248 at this time. Patch status is not yet confirmed—check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for current remediation guidance. Customers should ensure they are running supported versions and apply Oracle Critical Patch Updates promptly when patches become available. Until a patch is confirmed, restrict high privileged access to the infrastructure hosting Oracle VM VirtualBox to trusted personnel only.