Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in Oracle VM VirtualBox version 7.2.12 allows a low‑privileged host user to execute a flaw that grants complete control over the VirtualBox application, effectively compromising the virtualization environment. This takeover results in loss of confidentiality, integrity, and availability for the virtualization host.

Affected Systems

Oracle Corporation's Oracle VM VirtualBox 7.2.12 is the vulnerable product. No other versions or platform variations are listed as affected.

Risk and Exploitability

The CVSS 3.1 base score of 7.8 indicates high severity with confidentiality, integrity, and availability impacts. The attack vector is local, requiring low authentication and no user interaction. The EPSS score is less than 1 %, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Despite the low exploit likelihood, the ability to take over VirtualBox makes it a significant risk in environments that run this software.

Generated by OpenCVE AI on August 4, 2026 at 05:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest official Oracle VM VirtualBox update that removes CVE-2026-47047, as referenced in Oracle's security advisory.
  • Restrict local access to the host and enforce least‑privilege for accounts that can run VirtualBox.
  • If VirtualBox is not required for operations, uninstall the software or disable its services to eliminate the attack surface.

Generated by OpenCVE AI on August 4, 2026 at 05:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Title Enterprise Virtualization Local Privilege Escalation in Oracle VM VirtualBox 7.2.12

Tue, 28 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Title Enterprise Virtualization Local Privilege Escalation in Oracle VM VirtualBox 7.2.12

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle vm Virtualbox
CPEs cpe:2.3:a:oracle:vm_virtualbox:7.2.12:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle vm Virtualbox
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Vm Virtualbox
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-28T03:56:53.806Z

Reserved: 2026-05-18T15:55:10.319Z

Link: CVE-2026-47047

cve-icon Vulnrichment

Updated: 2026-07-23T15:41:46.898Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T05:15:03Z

Weaknesses
  • CWE-269

    Improper Privilege Management