CVE-2026-46825: Medium severity Oracle Oracle VM VirtualBox vulnerability
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict logon and management access to infrastructure running Oracle VM VirtualBox to trusted administrative accounts and IP addresses. Use firewalls/ACLs to limit access to VM host management ports, apply network segmentation to isolate hosts running VirtualBox from general user networks, and enforce least-privilege for local and remote accounts that can log on to those hosts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46825?
CVE-2026-46825 has a medium severity rating of 6.
How do I fix CVE-2026-46825?
To mitigate CVE-2026-46825, users should upgrade to the latest version of Oracle VM VirtualBox beyond 7.2.8.
What is the risk associated with CVE-2026-46825?
CVE-2026-46825 poses a risk level of 32, indicating it is easily exploitable by a high privileged attacker.
Who is affected by CVE-2026-46825?
Users of Oracle VM VirtualBox version 7.2.8 are affected by CVE-2026-46825.
What component is involved in CVE-2026-46825?
CVE-2026-46825 specifically involves vulnerability in the VMSVGA device component of Oracle VM VirtualBox.