This vulnerability (CVE-2026-46815) affects Oracle VM VirtualBox 7.2.8, specifically the VMSVGA device component. It permits a high privileged attacker who already has logon access to the infrastructure hosting Oracle VM VirtualBox to compromise the product. The scope of impact extends beyond Oracle VM VirtualBox to other Oracle products. The main impact is unauthorized read access to a subset of data accessible by Oracle VM VirtualBox. The CVSS 3.1 vector indicates the attack requires local access with low complexity, high privileges, no user interaction, and results in a confidentiality impact with scope change. Oracle’s June 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly confirm a dedicated patch for version 7.2.8. Oracle strongly advises applying all relevant Critical Security Patch Updates to reduce risk.

Successful exploitation results in unauthorized read access to some data accessible by Oracle VM VirtualBox, potentially affecting confidentiality. There is no impact on integrity or availability. The vulnerability requires a high privileged attacker with local logon access to the infrastructure. The scope of impact may extend to additional Oracle products beyond Oracle VM VirtualBox.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update and any subsequent patches promptly to mitigate this vulnerability and others. Until patches are applied, reducing privileges for users who do not require them and blocking network protocols required by potential attacks may reduce risk, though these measures may affect functionality. No specific patch for Oracle VM VirtualBox 7.2.8 is explicitly confirmed in the advisory; patch status is not yet confirmed—check the vendor advisory for current remediation guidance.