CVE-2026-35245: High severity Oracle Oracle VM VirtualBox vulnerability

Published Apr 21, 2026

Updated

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via RDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Affected Software

2 affected components

Oracle Oracle VM VirtualBox=7.2.6

Oracle VM VirtualBox=7.2.6

Event History

Apr 21, 2026

CVE Published

via MITRE·08:35 PM

Data Sourced

via MITRE·08:35 PM

DescriptionSeverity

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-35245?

CVE-2026-35245 is considered to be easily exploitable and allows unauthenticated attackers with network access to compromise Oracle VM VirtualBox.

Which version of Oracle VM VirtualBox is affected by CVE-2026-35245?

CVE-2026-35245 affects Oracle VM VirtualBox version 7.2.6.

How do I fix CVE-2026-35245?

To fix CVE-2026-35245, it is recommended to upgrade to the latest version of Oracle VM VirtualBox provided by Oracle.

Who can exploit CVE-2026-35245?

CVE-2026-35245 can be exploited by unauthenticated attackers with network access via RDP.

What type of vulnerability is CVE-2026-35245?

CVE-2026-35245 is a core vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization.