Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-01-20
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation Leading to Full Host Compromise
Action: Urgent Patch
AI Analysis

Impact

The flaw exists in Oracle VM VirtualBox’s Core component and allows an attacker with high privileges who has logged into the host to compromise VirtualBox. Successful exploitation can grant the attacker control over VirtualBox, effectively leading to a takeover of the host, affecting confidentiality, integrity, and availability.

Affected Systems

Oracle VM VirtualBox versions 7.1.14 and 7.2.4 from Oracle Corporation are affected. The Core component in these releases contains the vulnerability.

Risk and Exploitability

The CVSS v3.1 score of 8.2 classifies the issue as high severity. The attack vector is local with high privilege; an attacker already needs local access to the host. The EPSS probability is below 1 %, indicating that widescale exploitation has not been observed, yet the potential for full host compromise drives a high impact rating. The vulnerability is not yet listed in the KEV catalog, but the severity and the control it grants warrant prompt action.

Generated by OpenCVE AI on April 18, 2026 at 15:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official patch or upgrade to a non‑affected VirtualBox release as described in Oracle’s January 2026 security advisory.
  • Restrict local accounts that run VirtualBox by enforcing the principle of least privilege and limiting unnecessary administrative rights.
  • Monitor host resource usage and audit VirtualBox logs for abnormal activity; disable VirtualBox services if they are not essential for business operations.

Generated by OpenCVE AI on April 18, 2026 at 15:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 18 Apr 2026 16:00:00 +0000

Type Values Removed Values Added
Title VirtualBox Core Privilege Escalation Enables Full Host Compromise

Wed, 21 Jan 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Jan 2026 22:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle vm Virtualbox
CPEs cpe:2.3:a:oracle:vm_virtualbox:7.1.14:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:7.2.4:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle vm Virtualbox
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Vm Virtualbox
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-02-26T14:44:39.742Z

Reserved: 2026-01-05T18:07:34.713Z

Link: CVE-2026-21956

cve-icon Vulnrichment

Updated: 2026-01-21T15:28:43.327Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-20T22:15:58.477

Modified: 2026-01-29T16:02:15.570

Link: CVE-2026-21956

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T15:45:04Z

Weaknesses