This vulnerability in Oracle VM VirtualBox 7.2.8 involves an easily exploitable flaw that permits a high privileged attacker who already has logon access to the host system to compromise the VirtualBox environment. The attack can lead to unauthorized disclosure of a subset of data accessible by Oracle VM VirtualBox. The CVSS 3.1 vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and low confidentiality impact without integrity or availability impact. The vendor advisory does not explicitly confirm a patch for this specific CVE but strongly urges customers to apply the June 2026 Critical Security Patch Update, which includes numerous fixes across Oracle products.

The impact is limited to unauthorized read access to some Oracle VM VirtualBox accessible data. There is no impact on data integrity or availability. The vulnerability requires high privileges and local access to the host system where Oracle VM VirtualBox runs. The scope of the vulnerability extends beyond VirtualBox itself, potentially affecting additional Oracle products. The CVSS score of 3.2 reflects a low severity confidentiality impact.

Oracle has not explicitly stated a dedicated patch for CVE-2026-46874 in the provided advisory. However, Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which addresses numerous vulnerabilities across Oracle products including Oracle VM VirtualBox. Until patches are applied, risk may be reduced by limiting high privilege access to the infrastructure hosting Oracle VM VirtualBox and restricting access to relevant packages or network protocols required for exploitation. Customers should remain on actively supported versions and apply security patches promptly as per Oracle's guidance.