Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).
Published: 2026-08-18
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An exploitable flaw in the core component of Oracle VM VirtualBox 7.2.14 allows a high‑privileged local user to gain unauthorized access to all VirtualBox data the service can read, potentially exposing sensitive configuration files, virtual machine images, or other critical assets. The impact manifests as confidentiality loss for data that the VirtualBox service can access, with no immediate impact on integrity or availability reported.

Affected Systems

The affected system is Oracle VirtualBox 7.2.14, provided by Oracle Corporation. The vulnerability resides in the Core component of the product.

Risk and Exploitability

The CVSS 3.1 score of 6.0 classifies this flaw as a moderate severity vulnerability. The attack vector is local, with a low complexity requirement, and high privileges are needed to exploit it. No public exploitation has been reported, and the issue is not listed in the CISA KEV catalog. The EPSS score of < 1% indicates a very low probability of exploitation. Nonetheless, environments where host accounts used to run VirtualBox possess excessive privileges face a moderate risk.

Generated by OpenCVE AI on August 20, 2026 at 19:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch released in Oracle’s Security Alert for VirtualBox 7.2.14
  • Restrict login credentials of employees that have local admin rights on servers running VirtualBox
  • Review file system permissions for VirtualBox configuration directories to ensure only privileged administrators can modify them

Generated by OpenCVE AI on August 20, 2026 at 19:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Title High-Privilege Local Exploit Allowing Unauthorized Access to VirtualBox Data

Thu, 20 Aug 2026 06:30:00 +0000

Type Values Removed Values Added
Title High-Privilege Local Exploit Allowing Unauthorized Access to VirtualBox Data

Thu, 20 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle VM VirtualBox 7.2.14
Weaknesses CWE-269

Wed, 19 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 19 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle VM VirtualBox 7.2.14
Weaknesses CWE-269

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).
First Time appeared Oracle
Oracle vm Virtualbox
CPEs cpe:2.3:a:oracle:vm_virtualbox:7.2.14:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle vm Virtualbox
References
Metrics cvssV3_1

{'score': 6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Oracle Vm Virtualbox
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-19T16:00:57.970Z

Reserved: 2026-08-04T22:06:34.618Z

Link: CVE-2026-71114

cve-icon Vulnrichment

Updated: 2026-08-19T15:00:52.295Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:11.993

Modified: 2026-08-26T17:56:14.077

Link: CVE-2026-71114

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T19:15:04Z

Weaknesses