CVE-2026-46815: Infoleak
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Oracle VM VirtualBoxfrom your environment.If Oracle VM VirtualBox is not required in the environment, uninstall or remove it from affected hosts to eliminate exposure to the VMSVGA device vulnerability.
- Compensating control
Restrict access to hosts running Oracle VM VirtualBox to trusted, high-privilege administrators only; isolate those hosts on a separate network segment and restrict management access (SSH/WinRM/console) via firewall/ACLs to minimize potential attackers who can log on to the infrastructure.
- Operational
Audit and continuously monitor host logons and VirtualBox-related activity on systems running Oracle VM VirtualBox (including privilege account usage); investigate any suspicious or unexpected high-privilege logons to those hosts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46815?
The severity of CVE-2026-46815 is classified as low with a score of 3.2.
What are the known vulnerabilities associated with CVE-2026-46815?
CVE-2026-46815 is associated with an infoleak vulnerability in the VMSVGA device of Oracle VM VirtualBox.
How do I fix CVE-2026-46815?
To mitigate CVE-2026-46815, it is recommended to upgrade Oracle VM VirtualBox to a version higher than 7.2.8.
Who is affected by CVE-2026-46815?
CVE-2026-46815 affects users of Oracle VM VirtualBox version 7.2.8 who have high privileges in their infrastructure.
What type of attack can CVE-2026-46815 enable?
CVE-2026-46815 can enable a high privileged attacker to compromise the Oracle VM VirtualBox infrastructure.