This vulnerability in Oracle VM VirtualBox 7.2.14 (component: Core) permits an unauthenticated attacker with local access (logon) to the infrastructure hosting VirtualBox to compromise the product. Successful exploitation requires human interaction from a third party. The attack scope includes unauthorized creation, deletion, or modification of critical data, unauthorized read access to some data, and partial denial of service. The CVSS 3.1 base score is 7.7, reflecting low attack vector (local), low attack complexity, no privileges required, required user interaction, scope change, and impacts on confidentiality (low), integrity (high), and availability (low).

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data accessible by Oracle VM VirtualBox, unauthorized read access to a subset of data, and partial denial of service of the product. The vulnerability affects confidentiality, integrity, and availability, with a scope change potentially impacting additional products beyond VirtualBox.

Oracle has published this vulnerability in their August 2026 Critical Security Patch Update advisory. The advisory strongly recommends applying available security patches without delay. However, no explicit patch link or version fix is provided in the input data for Oracle VM VirtualBox 7.2.14. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Until patched, users should limit local access to the infrastructure and be aware that exploitation requires user interaction by a third party.