This vulnerability affects Oracle VM VirtualBox 7.2.14 and is classified under CWE-284 (Improper Access Control). An unauthenticated attacker with logon access to the infrastructure where Oracle VM VirtualBox runs can exploit this flaw, requiring user interaction from a third party, to compromise and take over Oracle VM VirtualBox. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 score of 8.6 and includes a scope change that may affect other products. Oracle has published this vulnerability in their August 2026 Critical Security Patch Update advisory but does not explicitly state patch availability for this specific version in the provided data.

Successful exploitation can result in full compromise and takeover of Oracle VM VirtualBox, impacting confidentiality, integrity, and availability of the affected system. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond VirtualBox. The attack requires user interaction from someone other than the attacker and access to the infrastructure where Oracle VM VirtualBox executes.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. The August 2026 Critical Security Patch Update advisory references this vulnerability, implying that patches are included in the update. However, explicit patch availability for Oracle VM VirtualBox 7.2.14 is not detailed in the provided advisory content. Users should consult the official Oracle Critical Security Patch Update documentation for patch availability and installation instructions. Until patched, limit access to infrastructure running Oracle VM VirtualBox to trusted users to reduce risk.