This vulnerability affects Oracle VM VirtualBox 7.2.14 and involves the core component of the product. It requires a high privileged attacker who already has logon access to the infrastructure where Oracle VM VirtualBox runs. Exploitation can lead to unauthorized access to critical or all accessible data within Oracle VM VirtualBox. The vulnerability has a CVSS 3.1 vector of AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N, indicating local attack vector, high attack complexity, high privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. The vulnerability is included in Oracle's August 2026 Critical Security Patch Update advisory.

Successful exploitation can result in unauthorized access to critical data or full access to all data accessible by Oracle VM VirtualBox. The scope of impact may extend to additional products due to the nature of the vulnerability. The CVSS score of 5.3 indicates a medium severity vulnerability primarily impacting confidentiality.

Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying patches without delay. No additional mitigation steps are specified beyond applying the official patch.