This vulnerability affects Oracle VM VirtualBox 7.2.14 and permits an unauthenticated attacker with network access via RDP to compromise the system. Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle VM VirtualBox, as well as unauthorized update, insert, or delete operations on some data. The CVSS 3.1 base score is 8.2, reflecting high confidentiality impact and low integrity impact, with no impact on availability. The vulnerability is identified as CWE-284 (Improper Access Control). Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly state the availability of a patch for version 7.2.14 in the provided excerpt.

An attacker can gain unauthorized access to critical data or full access to all data accessible by Oracle VM VirtualBox 7.2.14 via RDP without authentication. Additionally, the attacker may perform unauthorized modifications (update, insert, delete) on some of the accessible data. This compromises confidentiality and integrity of the data but does not affect availability.

Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. However, the provided advisory content does not explicitly confirm a patch for Oracle VM VirtualBox 7.2.14 for this vulnerability. Users should consult the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.