Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-08-18
Score: 3.4 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in the Core component of Oracle VM VirtualBox 7.2.14. If a high‑privileged attacker has logged on to the host system, they can exploit this flaw to modify, insert, or delete VirtualBox‑accessible data and also to read protected subsets of that data. The impact is limited to confidentiality and integrity; denial of service is not expected, which is reflected in the CVSS base score of 3.4.

Affected Systems

The only affected product is Oracle Corporation’s Oracle VM VirtualBox version 7.2.14. No other versions or components are listed as vulnerable.

Risk and Exploitability

The CVSS score of 3.4 indicates low severity. The attack vector is local and necessitates high privilege. The EPSS score suggests a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Because no official patch or workaround has been released, the primary mitigation is to restrict privileged access and monitor VirtualBox configuration and data files for unauthorized changes.

Generated by OpenCVE AI on August 20, 2026 at 16:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Restrict high‑privilege user accounts from logging into host systems that run VirtualBox
  • Enforce strict filesystem permissions on VirtualBox configuration and data files to prevent unauthorized modifications or reads
  • Implement monitoring of VirtualBox configuration and data file changes to detect tampering
  • Review Oracle’s security advisories for VirtualBox 7.2.14 and apply any available patches as soon as they are released

Generated by OpenCVE AI on August 20, 2026 at 16:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Title Local High-Privilege Data Modification and Read in Oracle VM VirtualBox 7.2.14

Thu, 20 Aug 2026 05:15:00 +0000

Type Values Removed Values Added
Title Local High-Privilege Data Modification and Read in Oracle VM VirtualBox 7.2.14

Wed, 19 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Title Local Privileged Attack Enables Unauthorized Data Modification in Oracle VM VirtualBox 7.2.14
Weaknesses CWE-200

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 09:00:00 +0000

Type Values Removed Values Added
Title Local Privileged Attack Enables Unauthorized Data Modification in Oracle VM VirtualBox 7.2.14
Weaknesses CWE-200
CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle vm Virtualbox
CPEs cpe:2.3:a:oracle:vm_virtualbox:7.2.14:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle vm Virtualbox
References
Metrics cvssV3_1

{'score': 3.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Vm Virtualbox
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-19T14:45:12.083Z

Reserved: 2026-08-04T22:06:34.620Z

Link: CVE-2026-71140

cve-icon Vulnrichment

Updated: 2026-08-19T14:26:18.911Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:14.903

Modified: 2026-08-25T19:03:03.440

Link: CVE-2026-71140

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T21:00:03Z

Weaknesses