This vulnerability affects Oracle VM VirtualBox 7.2.16 running on Windows hosts. It is an easily exploitable flaw that permits a low privileged attacker who can log on to the host system to compromise the Oracle VM VirtualBox software. Successful exploitation can lead to complete takeover of the Oracle VM VirtualBox environment. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local attack vector with low complexity, requiring low privileges and no user interaction, and results in high confidentiality, integrity, and availability impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which customers are strongly advised to apply promptly.

The vulnerability allows an attacker with low privileges on the Windows host running Oracle VM VirtualBox 7.2.16 to fully compromise the virtualization software. This can lead to complete control over Oracle VM VirtualBox, impacting confidentiality, integrity, and availability of the virtualized environment. There are no known exploits in the wild at this time. The high CVSS score reflects the serious nature of the compromise possible.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers running Oracle VM VirtualBox 7.2.16 on Windows hosts should apply the security patches provided in this update without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying all security patches to mitigate this and other vulnerabilities. No alternative mitigations or workarounds are specified in the advisory.