CVE-2026-87275

Published Sep 15, 2026 CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.6 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:L).

Analysis

Technical impact

The flaw resides in the core component of Oracle VM VirtualBox 7.2.16 and can be exploited by an attacker who has logged onto the host system. This local attack, which requires high privileges, permits the attacker to read a subset of data available to VirtualBox and to trigger a partial denial of service that causes the hypervisor to become unresponsive or restart. While the vulnerability is confined to VirtualBox, the scope change noted in the description implies that additional products interacting with the hypervisor could also be affected.

Affected Systems

Oracle Corporation’s VirtualBox version 7.2.16 is affected; other versions are not listed as vulnerable.

Risk and Exploitability

The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation in current environments. The vector indicates a local attack requiring high privileges. Successful exploitation leads to unauthorized data reading and a partial service outage for VirtualBox, with the potential to impact other products that rely on the hypervisor due to the scope change.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle VM VirtualBox

affected

Version	Status	Constraints
`7.2.16`	affected	—

Configuration 1 [-]

cpe:2.3:a:oracle:vm_virtualbox:7.2.16:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Vm Virtualbox

Version	Status	Scheme	Platform
`7.2.16`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Oracle VM VirtualBox 7.2.17 or later where the issue is fixed
If an upgrade is not feasible, restrict access to the host to trusted users only and consider removing or disabling VirtualBox where it is not essential
Monitor host logs for unexpected virtual machine activity and apply configuration hardening to limit VM visibility

Generated by OpenCVE AI on September 18, 2026 at 16:53 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.159% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.oracle.com/security-alerts/cspusep2026.html

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 18, 2026 9:30 PM Title updated View changes

Type	Values Removed	Values Added
Title	VirtualBox 7.2.16 Authorization Bypass and Partial DoS

Sep 17, 2026 12:45 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		VirtualBox 7.2.16 Authorization Bypass and Partial DoS
Weaknesses		CWE-284

Sep 15, 2026 8:15 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.6 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:L).
First Time appeared		Oracle Oracle vm Virtualbox
CPEs		cpe:2.3:a:oracle:vm_virtualbox:7.2.16:::::::*
Vendors & Products		Oracle Oracle vm Virtualbox
References		https://www.oracle.com/security-alerts/cspusep2026.html
Metrics		cvssV3_1 `{'score': 4.6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:L'}`