CVE-2026-46768: Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. in Oracle Corporation Oracle
CVE-2026-46768 is a vulnerability in Oracle VM VirtualBox version 7.2.8 affecting the VMSVGA device component. A high privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox runs can exploit this vulnerability to cause a hang or frequent crashes, resulting in a complete denial of service (DoS). The vulnerability impacts availability but does not affect confidentiality or integrity. The vulnerability has a CVSS 3.1 base score of 6.0, indicating medium severity. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update advisory but has not explicitly confirmed patch availability for this specific issue. Oracle strongly recommends applying Critical Security Patch Updates promptly to mitigate risks. No known exploits in the wild have been reported for this vulnerability.
AI Analysis
Technical Summary
CVE-2026-46768 is a medium severity vulnerability in Oracle VM VirtualBox 7.2.8, specifically in the VMSVGA device component. It allows a high privileged attacker with logon access to the host infrastructure to compromise Oracle VM VirtualBox by causing a hang or repeated crashes, resulting in a complete denial of service. The vulnerability has a CVSS 3.1 vector of AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, indicating local attack vector, low attack complexity, high privileges required, no user interaction, scope change, no confidentiality or integrity impact, and high availability impact. The vulnerability may also affect additional products due to scope change. Oracle’s June 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation level for Oracle VM VirtualBox 7.2.8. Oracle recommends applying security patches promptly to reduce risk. No exploits are currently known in the wild.
Potential Impact
Successful exploitation of this vulnerability can cause Oracle VM VirtualBox 7.2.8 to hang or crash repeatedly, resulting in a complete denial of service (DoS). This impacts the availability of the virtualization environment but does not compromise confidentiality or integrity. The vulnerability requires high privileges and local access to the infrastructure where Oracle VM VirtualBox executes. Due to scope change, additional products relying on Oracle VM VirtualBox may also be impacted by this denial of service condition.
Mitigation Recommendations
Oracle’s June 2026 Critical Security Patch Update advisory strongly recommends applying security patches as soon as possible to mitigate this and other vulnerabilities. However, the advisory does not explicitly confirm the availability of a patch or official fix specifically for Oracle VM VirtualBox 7.2.8 related to CVE-2026-46768. Until a patch is applied, risk may be reduced by limiting high privileged user access to the infrastructure running Oracle VM VirtualBox. Removing unnecessary privileges or restricting access to affected components may help reduce attack surface but could impact functionality. Monitor Oracle’s advisory page for updates on patch availability and apply patches promptly once released.
CVE-2026-46768: Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. in Oracle Corporation Oracle
Description
CVE-2026-46768 is a vulnerability in Oracle VM VirtualBox version 7.2.8 affecting the VMSVGA device component. A high privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox runs can exploit this vulnerability to cause a hang or frequent crashes, resulting in a complete denial of service (DoS). The vulnerability impacts availability but does not affect confidentiality or integrity. The vulnerability has a CVSS 3.1 base score of 6.0, indicating medium severity. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update advisory but has not explicitly confirmed patch availability for this specific issue. Oracle strongly recommends applying Critical Security Patch Updates promptly to mitigate risks. No known exploits in the wild have been reported for this vulnerability.
CVSS v3.1
Score 6.0medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-46768 is a medium severity vulnerability in Oracle VM VirtualBox 7.2.8, specifically in the VMSVGA device component. It allows a high privileged attacker with logon access to the host infrastructure to compromise Oracle VM VirtualBox by causing a hang or repeated crashes, resulting in a complete denial of service. The vulnerability has a CVSS 3.1 vector of AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, indicating local attack vector, low attack complexity, high privileges required, no user interaction, scope change, no confidentiality or integrity impact, and high availability impact. The vulnerability may also affect additional products due to scope change. Oracle’s June 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation level for Oracle VM VirtualBox 7.2.8. Oracle recommends applying security patches promptly to reduce risk. No exploits are currently known in the wild.
Potential Impact
Successful exploitation of this vulnerability can cause Oracle VM VirtualBox 7.2.8 to hang or crash repeatedly, resulting in a complete denial of service (DoS). This impacts the availability of the virtualization environment but does not compromise confidentiality or integrity. The vulnerability requires high privileges and local access to the infrastructure where Oracle VM VirtualBox executes. Due to scope change, additional products relying on Oracle VM VirtualBox may also be impacted by this denial of service condition.
Mitigation Recommendations
Oracle’s June 2026 Critical Security Patch Update advisory strongly recommends applying security patches as soon as possible to mitigate this and other vulnerabilities. However, the advisory does not explicitly confirm the availability of a patch or official fix specifically for Oracle VM VirtualBox 7.2.8 related to CVE-2026-46768. Until a patch is applied, risk may be reduced by limiting high privileged user access to the infrastructure running Oracle VM VirtualBox. Removing unnecessary privileges or restricting access to affected components may help reduce attack surface but could impact functionality. Monitor Oracle’s advisory page for updates on patch availability and apply patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-05-18T15:55:10.296Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cspujun2026.html","vendor":"Oracle"}]
Threat ID: 6a31b6040b89be68882655f7
Added to database: 06/16/2026, 20:45:56 UTC
Last enriched: 06/24/2026, 16:24:26 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 45
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.