CVE-2026-46873: High severity Oracle Oracle VM VirtualBox vulnerability
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict and harden administrative/logon access to infrastructure hosts where Oracle VM VirtualBox runs — allow only trusted, high-privilege administrators, apply host-based access controls, and limit management access by source IP where possible.
- Compensating control
Isolate or segment systems running Oracle VM VirtualBox (network segmentation, VLANs, firewalls) to reduce potential lateral impact to other products and infrastructure in case of compromise.
- Operational
Inventory your environment to identify all Oracle VM VirtualBox installations and explicitly flag any hosts running version 7.2.8 (the supported affected version called out in the advisory).
- Operational
If compromise is suspected on any host running Oracle VM VirtualBox, immediately isolate the host(s) from the network and follow incident response procedures to contain and investigate the takeover.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46873?
The severity of CVE-2026-46873 is rated high with a score of 7.5.
How do I fix CVE-2026-46873?
To fix CVE-2026-46873, users should upgrade Oracle VM VirtualBox to version 7.2.9 or later.
What component of Oracle VM VirtualBox does CVE-2026-46873 affect?
CVE-2026-46873 affects the VMSVGA device component of Oracle VM VirtualBox.
Who is at risk from CVE-2026-46873?
CVE-2026-46873 poses a risk primarily to high privileged attackers with logon access to the infrastructure where Oracle VM VirtualBox runs.
What is the exploitability of CVE-2026-46873?
CVE-2026-46873 is considered a difficult to exploit vulnerability, requiring specific access to the infrastructure.