CVE-2026-46768: Medium severity Oracle Oracle VM VirtualBox vulnerability
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict administrative/high-privilege logons to the infrastructure hosts that run Oracle VM VirtualBox to only trusted, authorized accounts (enforce least privilege and multi-factor authentication) since the vulnerability requires a high-privileged attacker with logon to the host.
- Compensating control
Isolate or segment hosts running Oracle VM VirtualBox from untrusted networks and other critical systems (use firewall rules, ACLs or network segmentation) to limit potential impact and lateral scope change from successful attacks.
- Operational
Prepare detection and recovery procedures for Oracle VM VirtualBox hangs/crashes (monitor availability, collect diagnostics, and have documented restart/recovery steps) to reduce outage impact if this vulnerability is exploited.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46768?
The severity of CVE-2026-46768 is medium with a score of 6.
How do I fix CVE-2026-46768?
To fix CVE-2026-46768, upgrade to a version of Oracle VM VirtualBox that is not affected by this vulnerability.
What products are affected by CVE-2026-46768?
CVE-2026-46768 affects the Oracle VM VirtualBox version 7.2.8.
Who can exploit CVE-2026-46768?
CVE-2026-46768 can be exploited by a high privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox operates.
What component of Oracle VM VirtualBox is involved in CVE-2026-46768?
CVE-2026-46768 involves a vulnerability in the VMSVGA device component of Oracle VM VirtualBox.