This vulnerability affects Oracle VM VirtualBox 7.2.12 and is classified under CWE-269 (Improper Privilege Management). It requires a high privileged attacker with local access (logon) to the infrastructure where Oracle VM VirtualBox runs. The vulnerability allows the attacker to compromise Oracle VM VirtualBox, potentially gaining unauthorized access to all data accessible by VirtualBox and causing a partial denial of service. The CVSS 3.1 base score is 6.1, reflecting high impact on confidentiality and low impact on availability, with no impact on integrity. The scope is changed, meaning the vulnerability in VirtualBox can impact additional Oracle products. The vendor advisory from Oracle’s July 2026 Critical Patch Update does not explicitly confirm a patch for this specific vulnerability, and no patch links are provided.

Successful exploitation can result in unauthorized access to critical data within Oracle VM VirtualBox and a partial denial of service condition. The confidentiality impact is high, availability impact is low, and integrity is not affected. The vulnerability requires high privileges and local access, limiting the attack surface. The scope change indicates that other Oracle products dependent on or integrated with VirtualBox could also be impacted indirectly.

The vendor advisory does not explicitly confirm the availability of a patch or fix for this vulnerability. Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all available security patches promptly and remaining on actively supported versions. Until a patch is confirmed, ensure that only trusted users have high privileged access to the infrastructure running Oracle VM VirtualBox.