CVE-2026-46873 is a vulnerability in Oracle VM VirtualBox 7.2.8's VMSVGA device component that allows a high privileged attacker with logon access to compromise the product, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) with attack vector local, high attack complexity, high privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability. Oracle has issued a Critical Security Patch Update advisory recommending customers apply patches promptly and implement mitigations such as limiting privileges and blocking network protocols required by an attack. The patch status for this version is not explicitly confirmed in the advisory, so users should consult Oracle's June 2026 Critical Security Patch Update for current remediation guidance.

Successful exploitation allows a high privileged attacker with logon access to the infrastructure running Oracle VM VirtualBox 7.2.8 to fully compromise Oracle VM VirtualBox. This can lead to complete takeover of the virtualization product and may also impact additional products due to scope change. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible. Until patches are applied, risk can be reduced by limiting user privileges to only those necessary and blocking network protocols required by an attack. Customers should follow Oracle's official advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions. Patch status for Oracle VM VirtualBox 7.2.8 is not explicitly confirmed; therefore, users must verify current remediation guidance from Oracle.