This vulnerability affects Oracle VM VirtualBox 7.2.6 and involves improper access control (CWE-284) that allows a high privileged local attacker to perform unauthorized modifications (update, insert, delete) on data accessible by VirtualBox. The attack requires local access with high privileges and does not require user interaction. The vulnerability impacts integrity but not confidentiality or availability. The scope of impact extends beyond Oracle VM VirtualBox to other Oracle products. The CVSS vector is AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N, with a base score of 3.2 (low severity). Oracle’s April 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a fix for this CVE. Patch status is therefore not confirmed and should be verified with Oracle’s advisory.

Successful exploitation allows a high privileged local attacker to modify data accessible by Oracle VM VirtualBox, potentially affecting the integrity of that data. There is no impact on confidentiality or availability. The vulnerability’s scope change indicates that other Oracle products relying on VirtualBox may also be impacted. No known exploits in the wild have been reported to date.

Patch status for CVE-2026-35249 is not explicitly confirmed in the Oracle April 2026 Critical Patch Update advisory. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for the latest patch availability and remediation instructions. Oracle strongly recommends applying Critical Patch Updates promptly to mitigate vulnerabilities. Until a patch is confirmed and applied, restrict high privileged local access to systems running Oracle VM VirtualBox to trusted administrators only.