CVE-2026-46977: Infoleak
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict logon access to infrastructure hosts running Oracle VM VirtualBox (component: VMSVGA device; affected supported version: 7.2.8) to a minimal set of trusted, high‑privileged administrators using firewall rules, ACLs, VPNs, or jump hosts.
- Compensating control
Isolate systems running Oracle VM VirtualBox from sensitive networks and production workloads (network segmentation) so that a compromised host cannot be used to access additional products or sensitive data.
- Compensating control
Enable and centralize audit logging and monitoring for privileged logons and administrative actions on hosts running Oracle VM VirtualBox; create alerts for unusual privileged activity and investigate promptly.
- Operational
Review and reduce the number of high‑privileged accounts with logon access to infrastructure hosting Oracle VM VirtualBox; remove or restrict unnecessary privileges and access while investigation and remediation are completed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46977?
The severity of CVE-2026-46977 is classified as low with a score of 3.2.
How do I fix CVE-2026-46977?
To fix CVE-2026-46977, update Oracle VM VirtualBox to version 7.2.9 or later.
Who is affected by CVE-2026-46977?
CVE-2026-46977 affects users of Oracle VM VirtualBox version 7.2.8.
What type of vulnerability is CVE-2026-46977?
CVE-2026-46977 is identified as an information leak vulnerability.
What can an attacker do with CVE-2026-46977?
An attacker exploiting CVE-2026-46977 could compromise the Oracle VM VirtualBox environment if they have high privileges and access.