CVE-2026-46877: Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. in Oracle Corporation Oracle VM Vi
CVE-2026-46877 is a vulnerability in Oracle VM VirtualBox version 7.2.8 affecting the VMSVGA device component. It allows a high privileged attacker with local access to the infrastructure running Oracle VM VirtualBox to compromise the product. Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by Oracle VM VirtualBox. The vulnerability has a CVSS 3.1 base score of 6.0, indicating medium severity with significant confidentiality impact but no integrity or availability impact. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update advisory but has not explicitly stated a dedicated patch for this version in the advisory content provided. Oracle strongly recommends applying Critical Security Patch Updates promptly to mitigate risks. No known exploits in the wild have been reported at this time.
AI Analysis
Technical Summary
CVE-2026-46877 is a medium severity vulnerability in Oracle VM VirtualBox 7.2.8, specifically in the VMSVGA device component. It permits a high privileged local attacker to compromise Oracle VM VirtualBox, potentially gaining unauthorized access to critical or all accessible data within the virtualization environment. The vulnerability has a CVSS 3.1 vector of AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, indicating local attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. The vulnerability is included in Oracle's June 2026 Critical Security Patch Update advisory, which bundles 245 security patches across multiple products. Oracle emphasizes timely application of these patches to reduce risk. However, the advisory does not explicitly confirm a dedicated patch for Oracle VM VirtualBox 7.2.8 or this specific CVE. No exploits are currently known in the wild.
Potential Impact
Successful exploitation of this vulnerability allows a high privileged local attacker to compromise Oracle VM VirtualBox 7.2.8, resulting in unauthorized access to critical data or complete access to all data accessible by the virtualization product. The impact is limited to confidentiality, with no direct impact on integrity or availability. The vulnerability also has a scope change, meaning it may affect additional products beyond Oracle VM VirtualBox.
Mitigation Recommendations
Oracle has included this vulnerability in its June 2026 Critical Security Patch Update advisory and strongly recommends applying the Critical Security Patch Update patches as soon as possible to mitigate the risk. Until patches are applied, risk may be reduced by restricting privileges and access to the affected infrastructure and blocking network protocols required by potential attacks, though these may impact functionality. No explicit dedicated patch or temporary fix for Oracle VM VirtualBox 7.2.8 is confirmed in the advisory content provided. Customers should monitor Oracle's official advisory for updates and apply patches promptly.
CVE-2026-46877: Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. in Oracle Corporation Oracle VM Vi
Description
CVE-2026-46877 is a vulnerability in Oracle VM VirtualBox version 7.2.8 affecting the VMSVGA device component. It allows a high privileged attacker with local access to the infrastructure running Oracle VM VirtualBox to compromise the product. Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by Oracle VM VirtualBox. The vulnerability has a CVSS 3.1 base score of 6.0, indicating medium severity with significant confidentiality impact but no integrity or availability impact. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update advisory but has not explicitly stated a dedicated patch for this version in the advisory content provided. Oracle strongly recommends applying Critical Security Patch Updates promptly to mitigate risks. No known exploits in the wild have been reported at this time.
CVSS v3.1
Score 6.0medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-46877 is a medium severity vulnerability in Oracle VM VirtualBox 7.2.8, specifically in the VMSVGA device component. It permits a high privileged local attacker to compromise Oracle VM VirtualBox, potentially gaining unauthorized access to critical or all accessible data within the virtualization environment. The vulnerability has a CVSS 3.1 vector of AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, indicating local attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. The vulnerability is included in Oracle's June 2026 Critical Security Patch Update advisory, which bundles 245 security patches across multiple products. Oracle emphasizes timely application of these patches to reduce risk. However, the advisory does not explicitly confirm a dedicated patch for Oracle VM VirtualBox 7.2.8 or this specific CVE. No exploits are currently known in the wild.
Potential Impact
Successful exploitation of this vulnerability allows a high privileged local attacker to compromise Oracle VM VirtualBox 7.2.8, resulting in unauthorized access to critical data or complete access to all data accessible by the virtualization product. The impact is limited to confidentiality, with no direct impact on integrity or availability. The vulnerability also has a scope change, meaning it may affect additional products beyond Oracle VM VirtualBox.
Mitigation Recommendations
Oracle has included this vulnerability in its June 2026 Critical Security Patch Update advisory and strongly recommends applying the Critical Security Patch Update patches as soon as possible to mitigate the risk. Until patches are applied, risk may be reduced by restricting privileges and access to the affected infrastructure and blocking network protocols required by potential attacks, though these may impact functionality. No explicit dedicated patch or temporary fix for Oracle VM VirtualBox 7.2.8 is confirmed in the advisory content provided. Customers should monitor Oracle's official advisory for updates and apply patches promptly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-05-18T15:55:10.308Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cspujun2026.html","vendor":"Oracle"}]
Threat ID: 6a31b61e0b89be6888265bb4
Added to database: 06/16/2026, 20:46:22 UTC
Last enriched: 06/24/2026, 16:29:11 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 79
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.