CVE-2026-35249

CVE-2026-35249 is a local integrity vulnerability affecting Oracle VM VirtualBox version 7.2.6, specifically in the Core component. While the vulnerability resides in VirtualBox, successful exploitation may impact additional products due to scope change. The vulnerability presents a low severity risk with a CVSS 3.1 base score of 3.2. It requires local access and high-level privileges to exploit, making it accessible only to attackers with administrative or infrastructure access to the host system. The primary impact is limited to unauthorized data modification within VirtualBox accessible data, with no confidentiality or availability impacts. There is no evidence of active exploitation or public exploit code availability. The vulnerability is not included in CISA's Known Exploited Vulnerabilities (KEV) catalog and is not on any active hot list. Community attention remains minimal, with an extremely low EPSS score of 0.00011, indicating negligible real-world exploitation probability.