CVE-2026-35275: Oracle VM VirtualBox Shared Folders Privilege Escalation Vulnerability (CVSS 7.5)

Technical summary

CVE-2026-35275 is a privilege-escalation vulnerability in the Shared Folders component of Oracle VM VirtualBox 7.2.8. The flaw stems from an improper access control mechanism (CWE-284) that permits a low-privileged local user to bypass isolation boundaries. The attack surface is local; no network component is required. The vulnerability exhibits scope change—meaning the impact extends beyond VirtualBox itself to other systems on the network or connected infrastructure. Exploitation does not require user interaction and yields high confidentiality and integrity impacts, though availability is not affected.

Business impact

If exploited, this vulnerability could allow an insider or lateral-movement attacker to read, modify, or delete sensitive data housed in VirtualBox virtual machines. In environments where VirtualBox hosts contain business-critical applications, databases, or development environments, a compromise could lead to intellectual property theft, data corruption, or service disruption. The scope-change aspect means the impact is not confined to a single VM—an attacker could potentially pivot to access host systems or other connected infrastructure, amplifying the breach radius.

Affected systems

Oracle VM VirtualBox version 7.2.8 is confirmed affected. Organizations running this version on any operating system (Linux, Windows, macOS) where VirtualBox is installed should review their inventory and patching timelines. Systems in environments with shared infrastructure or multi-tenant setups face elevated risk due to the local-access requirement and scope-change nature of the vulnerability.

Exploitability

The CVSS vector rates this as 'difficult to exploit' (AC:H—attack complexity high) despite the moderate base score of 7.5. Exploitation requires the attacker to have already gained local logon privileges on the host system and to manipulate the Shared Folders feature under specific conditions. This is not a remote code execution vulnerability and does not spread across the network on its own. However, the low barrier to entry once local access is obtained and the absence of user interaction required (UI:N) make it a practical post-compromise risk in insider-threat or lateral-movement scenarios.

Remediation

Oracle will release a patched version of VirtualBox to address this flaw. Security teams should monitor Oracle's official security advisories for version 7.2.9 or later and plan immediate deployment to systems running 7.2.8. If immediate patching is not feasible, restrict local logon privileges on hosts running VirtualBox, enforce host-based access controls on the .vbox files and shared folder mount points, and isolate VirtualBox hosts on restricted network segments.

Patch guidance

Verify the latest patched version against Oracle's official VirtualBox security advisory (published 2026-06-17). Apply patches to all systems running version 7.2.8 within your organization. Test patches in a non-production environment first to ensure compatibility with existing virtual machines and host configurations. Consider scheduling updates during maintenance windows to avoid service interruption. If your organization uses VirtualBox in production clusters or critical infrastructure, coordinate patching across all instances to maintain operational continuity.

Detection guidance

Monitor for unauthorized access to VirtualBox configuration files (.vbox, .vdi) and shared folder mounts by low-privileged users. Log and alert on any attempts to modify virtual machine settings or data via the Shared Folders interface. Host-based intrusion detection systems should flag unusual file system activity within VirtualBox data directories. Periodically audit user permissions on VirtualBox installation directories and shared folder access controls. Correlate failed and successful local login attempts with subsequent VirtualBox process spawning to identify potential exploitation chains.

Why prioritize this

Although this vulnerability requires local access and is difficult to exploit, the HIGH severity rating (7.5 CVSS), high confidentiality and integrity impacts, and scope-change characteristic warrant prompt prioritization. Organizations with high-privilege users on shared or multi-tenant hosts, or those using VirtualBox to isolate sensitive development or test environments, face material risk. The vulnerability does not appear on CISA's KEV catalog at present, but that should not defer action; local-access vulnerabilities in virtualization software can enable rapid lateral movement once a foothold is established.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a vulnerability that is locally exploitable (AV:L), difficult to trigger (AC:H), requires low privileges (PR:L), and produces significant breach of confidentiality (C:H) and integrity (I:H) with no availability impact (A:N). The scope-change indicator (S:C) elevates the risk profile by acknowledging that compromise of VirtualBox can cascade to other resources. The absence of network exposure and the attack complexity keep the score from reaching 'Critical,' but the impact on data security is substantial enough to merit rapid remediation.

Frequently asked questions