CVE-2026-35275: High severity Oracle Oracle VM VirtualBox vulnerability
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Shared Folders). The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
oracle/virtualboxfrom your environment.Uninstall Oracle VM VirtualBox from hosts where it is not required, particularly if running the affected version 7.2.8.
- Configuration
Disable the Shared Folders feature in Oracle VM VirtualBox on systems running the affected version 7.2.8 if the feature is not required.
Oracle VM VirtualBox (Shared Folders) shared_folders_enabled = false - Compensating control
Restrict logon and administrative access to hosts running Oracle VM VirtualBox (affected: 7.2.8) to trusted accounts only; apply network ACLs/firewall rules to limit access to management interfaces and the infrastructure where VirtualBox executes.
- Operational
Monitor Oracle security advisories for a vendor-supplied fix for this vulnerability and apply any released patches promptly; test and deploy updates to affected systems.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35275?
CVE-2026-35275 has a severity rating of high, with a score of 7.5.
How do I fix CVE-2026-35275?
To fix CVE-2026-35275, update Oracle VM VirtualBox to version 7.2.9 or later.
Who is affected by CVE-2026-35275?
CVE-2026-35275 affects users of Oracle VM VirtualBox version 7.2.8.
What type of vulnerability is CVE-2026-35275?
CVE-2026-35275 is a low privileged access vulnerability related to Shared Folders in Oracle VM VirtualBox.
What impact does CVE-2026-35275 have on security?
CVE-2026-35275 allows a low privileged attacker to potentially compromise the system where Oracle VM VirtualBox is executed.