CVE-2026-47043: Oracle VM VirtualBox Information Disclosure

CVE-2026-47043 Overview

CVE-2026-47043 is an information disclosure vulnerability in the Core component of Oracle VM VirtualBox 7.2.12. A high-privileged attacker with local logon access to the infrastructure running Oracle VM VirtualBox can exploit this flaw. Successful exploitation grants unauthorized read access to a subset of Oracle VM VirtualBox accessible data. The vulnerability carries a scope change, meaning attacks may impact resources beyond the vulnerable component itself. Oracle addressed this issue in the July 2026 Critical Patch Update.

Critical Impact
A local, authenticated attacker can read sensitive VirtualBox data across trust boundaries due to a scope-changing information disclosure flaw in the Core component.

Affected Products

Oracle VM VirtualBox 7.2.12
Oracle Virtualization product family
Core component of Oracle VM VirtualBox

Discovery Timeline

2026-07-21 - CVE-2026-47043 published to NVD
2026-07-23 - Last updated in NVD database
July 2026 - Oracle publishes security patch via Critical Patch Update

Technical Details for CVE-2026-47043

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle VM VirtualBox, the hypervisor engine responsible for managing virtual machine execution. It is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. A local attacker holding high privileges on the host running VirtualBox can trigger the flaw to read data that should remain isolated.

The vulnerability produces a scope change, indicating that exploitation crosses a security authority boundary. In hypervisor contexts, this typically means data isolation between the host, the VirtualBox process, and guest virtual machines can be undermined. Only confidentiality is affected; integrity and availability of the system remain intact.

Exploitation does not require user interaction and has low attack complexity. However, the requirement for high privileges on the host constrains the pool of viable attackers to those who have already achieved administrative or equivalent access to the infrastructure. The EPSS probability of exploitation in the wild is 0.147%.

Root Cause

The root cause is improper restriction of access to internal Core component data. VirtualBox exposes data structures or interfaces that a privileged local caller can query, returning information that should be constrained to the calling authority. The specific technical mechanism has not been disclosed by Oracle beyond the summary in the July 2026 Critical Patch Update.

Attack Vector

The attack vector is local. An attacker must first obtain a high-privileged logon session on the host system where Oracle VM VirtualBox executes. From that session, the attacker interacts with the Core component to retrieve a subset of accessible data. See the Oracle Security Alert July 2026 for vendor guidance.

No public proof-of-concept exploit code has been released. Because realCodeExamples are not available for this CVE, exploitation details are described in prose only.

Detection Methods for CVE-2026-47043

Indicators of Compromise

Unexpected privileged process activity interacting with VBoxSVC, VBoxManage, or Core VirtualBox binaries on the host.
Unusual invocation patterns of VirtualBox management interfaces originating from administrative accounts.
Access to VirtualBox configuration or runtime files by processes outside expected VirtualBox parent processes.

Detection Strategies

Baseline normal administrative usage of Oracle VM VirtualBox binaries and alert on deviations.
Correlate high-privilege logon events with subsequent VirtualBox Core component API interactions.
Enable host-level auditing of process execution and file access for VirtualBox installation directories.

Monitoring Recommendations

Monitor administrative logon events on hosts running Oracle VM VirtualBox 7.2.12.
Track command-line arguments and parent-child process chains for VirtualBox utilities.
Ingest host process and audit telemetry into a centralized analytics platform to identify anomalous read access to VirtualBox data.

How to Mitigate CVE-2026-47043

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all systems running Oracle VM VirtualBox 7.2.12.
Inventory all hosts running Oracle VM VirtualBox and confirm patch status.
Restrict local high-privileged access on hypervisor hosts to the minimum required set of administrators.

Patch Information

Oracle released a fix for CVE-2026-47043 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for the exact patched version and download instructions. Upgrade Oracle VM VirtualBox from version 7.2.12 to the fixed release identified in that advisory.

Workarounds

Limit interactive and remote administrative access to VirtualBox hosts using least-privilege access controls.
Segment hypervisor management networks from general user networks to reduce exposure of privileged accounts.
Enforce multi-factor authentication for all accounts capable of logging on to VirtualBox hosts until patching is complete.

bash

# Verify installed Oracle VM VirtualBox version on Linux hosts
VBoxManage --version

# Verify installed Oracle VM VirtualBox version on Windows hosts
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" --version

# Enumerate hosts still running vulnerable version 7.2.12
# and prioritize them for the July 2026 Critical Patch Update