This vulnerability in Oracle VM VirtualBox 7.2.8's Shared Folders component permits a low privileged attacker who has logon access to the host system to compromise the VirtualBox environment. The scope of impact extends beyond VirtualBox itself, potentially affecting additional Oracle products. The vulnerability can lead to unauthorized creation, deletion, or modification of critical data accessible by Oracle VM VirtualBox, with high confidentiality and integrity impacts but no availability impact. The CVSS 3.1 vector is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, indicating local attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts. Oracle's June 2026 Critical Security Patch Update addresses this vulnerability among others, emphasizing the importance of timely patching.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data accessible by Oracle VM VirtualBox, compromising confidentiality and integrity of that data. The vulnerability affects the security boundary of Oracle VM VirtualBox and may impact additional Oracle products due to scope change. There is no impact on availability. The attack requires local access with low privileges and has a high attack complexity, making exploitation difficult but possible. No known exploits in the wild have been reported.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers are strongly advised to apply the June 2026 Critical Security Patch Update promptly to mitigate this risk. Until patches are applied, risk reduction may be possible by restricting access to the infrastructure where Oracle VM VirtualBox runs, removing unnecessary privileges from users, and blocking network protocols required by potential attacks, although these measures may affect functionality. Oracle recommends remaining on actively supported versions and applying security patches without delay.