Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H).
Published: 2026-08-18
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in Oracle VM VirtualBox 7.2.14’s Core component and permits an unauthenticated local attacker—anyone able to log into the host—to cause the application to hang or repeatedly crash, producing a denial of service. In addition, the flaw allows the attacker to update, insert, or delete certain VirtualBox-accessible data, thereby compromising data integrity. The weakness was classified under CVSS v3.1 with a base score of 6.1 and affects integrity (low) and availability (high).

Affected Systems

The affected product is Oracle VM VirtualBox version 7.2.14, distributed by Oracle Corporation. No other Oracle VirtualBox releases are listed as vulnerable.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of less than 1 % suggests low likelihood of active exploitation. The vulnerability is not listed in CISA’s KEV catalog. Because exploitation requires local host access and some user interaction beyond the attacker’s control, the risk to an environment with restricted physical or console access is limited; however, any systems with permissive local access should address the flaw promptly.

Generated by OpenCVE AI on August 24, 2026 at 22:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade VirtualBox to the latest patched release as announced in Oracle’s security alert.
  • Restrict local user permissions on the VirtualBox installation directory and privileged binaries to the minimum necessary.
  • Disable or remove automatically enabled VirtualBox services or network interfaces when virtual machines are not running.
  • Monitor VirtualBox logs and system events for unexpected crashes or unauthorized data changes and investigate promptly.

Generated by OpenCVE AI on August 24, 2026 at 22:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Title Local Unauthenticated Denial of Service and Data Integrity Vulnerability in Oracle VM VirtualBox 7.2.14

Mon, 24 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Title Local Authentication Vulnerability Enables DOS and Data Modification in Oracle VM VirtualBox 7.2.14
Weaknesses CWE-284
CWE-770

Mon, 24 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-363
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 03:15:00 +0000

Type Values Removed Values Added
Title Local Authentication Vulnerability Enables DOS and Data Modification in Oracle VM VirtualBox 7.2.14
Weaknesses CWE-284
CWE-770

Thu, 20 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Title Local Vulnerability Allows Unauthenticated VirtualBox Crashes and Data Modification
Weaknesses CWE-284
CWE-400

Wed, 19 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
Title Local Vulnerability Allows Unauthenticated VirtualBox Crashes and Data Modification
Weaknesses CWE-284
CWE-400

Wed, 19 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Local Attacker Can Cause Denial of Service and Data Modification in VirtualBox 7.2.14
Weaknesses CWE-284
CWE-400

Wed, 19 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Local Attacker Can Cause Denial of Service and Data Modification in VirtualBox 7.2.14
Weaknesses CWE-284
CWE-400

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H).
First Time appeared Oracle
Oracle vm Virtualbox
CPEs cpe:2.3:a:oracle:vm_virtualbox:7.2.14:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle vm Virtualbox
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'}

Subscriptions

Oracle Vm Virtualbox
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-24T18:45:12.451Z

Reserved: 2026-08-04T22:06:34.618Z

Link: CVE-2026-71125

cve-icon Vulnrichment

Updated: 2026-08-24T18:45:03.454Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:13.287

Modified: 2026-08-26T17:56:37.853

Link: CVE-2026-71125

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T23:00:06Z

Weaknesses
  • CWE-363

    Race Condition Enabling Link Following