This vulnerability affects Oracle VM VirtualBox 7.2.14 and involves the core component of the product. A high privileged attacker with logon access to the host infrastructure where Oracle VM VirtualBox runs can exploit this flaw to gain unauthorized read and write access to certain data within Oracle VM VirtualBox. The CVSS 3.1 vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts.

An attacker with high privileges on the host system can perform unauthorized read, insert, update, or delete operations on some data accessible by Oracle VM VirtualBox. This could compromise the integrity and confidentiality of that data but does not affect availability. The impact is limited to the data accessible by the product and requires already high privileges on the host.

Oracle has published a Critical Security Patch Update (CSPU) in August 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Since the affected version is 7.2.14, upgrading to a patched version as indicated in Oracle's advisory is recommended. No indication of temporary fixes or workarounds is provided, so patching is the primary mitigation.