This vulnerability affects Oracle VM VirtualBox, specifically version 7.2.16. It is exploitable by an unauthenticated attacker who has logon access to the infrastructure where Oracle VM VirtualBox runs. Exploitation requires user interaction from a third party and can result in full compromise of Oracle VM VirtualBox. The vulnerability causes a scope change, potentially impacting additional products beyond Oracle VM VirtualBox. The CVSS 3.1 vector indicates low attack complexity and no privileges required, but user interaction is necessary, and the scope is changed. Confidentiality, integrity, and availability impacts are all high. Oracle's advisory for the September 2026 Critical Security Patch Update includes this vulnerability among 673 patches released. The advisory strongly recommends applying patches promptly to mitigate exploitation risks.

Successful exploitation can lead to complete takeover of Oracle VM VirtualBox, affecting confidentiality, integrity, and availability of the system. The vulnerability's scope change means that other products relying on or integrated with Oracle VM VirtualBox may also be impacted. The attack requires an attacker to have logon access to the infrastructure and involves user interaction from a third party, which somewhat limits the attack vector but does not eliminate the risk of serious compromise.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches without delay to remediate this issue. Since the vulnerability requires user interaction and logon access, limiting access to the infrastructure and educating users about social engineering risks can also help reduce exposure. Patch status is confirmed by the vendor advisory indicating that a fix is available in the September 2026 Critical Security Patch Update.