CVE-2026-46977: Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. in Oracle Corporation Oracle VM VirtualBox
CVE-2026-46977 is a vulnerability in Oracle VM VirtualBox version 7.2.8 affecting the VMSVGA device component. It allows a high privileged attacker with local access to the infrastructure running VirtualBox to compromise the product, potentially impacting additional Oracle products. Successful exploitation can lead to unauthorized read access to some Oracle VM VirtualBox accessible data. The vulnerability has a low CVSS score of 3.2, indicating limited confidentiality impact without integrity or availability effects. No official patch or fix is explicitly stated in the vendor advisory as of the publication date. Oracle strongly recommends applying Critical Security Patch Updates promptly to mitigate risks from vulnerabilities including this one.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-46977) affects Oracle VM VirtualBox 7.2.8, specifically the VMSVGA device component. It permits a high privileged local attacker to compromise Oracle VM VirtualBox, with potential scope extension to other Oracle products. The impact is unauthorized read access to a subset of data accessible by Oracle VM VirtualBox. The CVSS 3.1 base score is 3.2, reflecting low severity with confidentiality impact only. The vendor advisory does not explicitly confirm a patch or remediation for this specific CVE but emphasizes the importance of applying the June 2026 Critical Security Patch Update, which includes numerous fixes across Oracle products. No known exploits in the wild have been reported.
Potential Impact
The vulnerability allows unauthorized read access to some data accessible by Oracle VM VirtualBox 7.2.8 when exploited by a high privileged local attacker. There is no impact on integrity or availability. The scope change indicates that other Oracle products may be affected indirectly. The overall severity is low based on the CVSS score and described impact.
Mitigation Recommendations
Oracle has not explicitly stated a dedicated patch or fix for CVE-2026-46977 in the provided advisory. However, Oracle strongly recommends applying the June 2026 Critical Security Patch Update promptly, which addresses multiple vulnerabilities across Oracle products. Until patches are applied, reducing risk may involve limiting high privileged user access to the infrastructure running Oracle VM VirtualBox. No vendor advisory states that no action is required or that the issue is already mitigated. Patch status is not yet confirmed—check the Oracle advisory for updates on remediation.
CVE-2026-46977: Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. in Oracle Corporation Oracle VM VirtualBox
Description
CVE-2026-46977 is a vulnerability in Oracle VM VirtualBox version 7.2.8 affecting the VMSVGA device component. It allows a high privileged attacker with local access to the infrastructure running VirtualBox to compromise the product, potentially impacting additional Oracle products. Successful exploitation can lead to unauthorized read access to some Oracle VM VirtualBox accessible data. The vulnerability has a low CVSS score of 3.2, indicating limited confidentiality impact without integrity or availability effects. No official patch or fix is explicitly stated in the vendor advisory as of the publication date. Oracle strongly recommends applying Critical Security Patch Updates promptly to mitigate risks from vulnerabilities including this one.
CVSS v3.1
Score 3.2low
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-46977) affects Oracle VM VirtualBox 7.2.8, specifically the VMSVGA device component. It permits a high privileged local attacker to compromise Oracle VM VirtualBox, with potential scope extension to other Oracle products. The impact is unauthorized read access to a subset of data accessible by Oracle VM VirtualBox. The CVSS 3.1 base score is 3.2, reflecting low severity with confidentiality impact only. The vendor advisory does not explicitly confirm a patch or remediation for this specific CVE but emphasizes the importance of applying the June 2026 Critical Security Patch Update, which includes numerous fixes across Oracle products. No known exploits in the wild have been reported.
Potential Impact
The vulnerability allows unauthorized read access to some data accessible by Oracle VM VirtualBox 7.2.8 when exploited by a high privileged local attacker. There is no impact on integrity or availability. The scope change indicates that other Oracle products may be affected indirectly. The overall severity is low based on the CVSS score and described impact.
Mitigation Recommendations
Oracle has not explicitly stated a dedicated patch or fix for CVE-2026-46977 in the provided advisory. However, Oracle strongly recommends applying the June 2026 Critical Security Patch Update promptly, which addresses multiple vulnerabilities across Oracle products. Until patches are applied, reducing risk may involve limiting high privileged user access to the infrastructure running Oracle VM VirtualBox. No vendor advisory states that no action is required or that the issue is already mitigated. Patch status is not yet confirmed—check the Oracle advisory for updates on remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-05-18T15:55:10.314Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cspujun2026.html","vendor":"Oracle"}]
Threat ID: 6a31b6350b89be68882668ea
Added to database: 06/16/2026, 20:46:45 UTC
Last enriched: 06/24/2026, 16:29:46 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 169
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.