Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).
Published: 2026-09-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

VirtualBox 7.2.16 allows a low‑privilege user to compromise the VirtualBox instance. The exploit requires a human interaction from another person and is of high complexity, but if successful it can lead to complete takeover of Oracle VM VirtualBox, thereby affecting confidentiality, integrity and availability as indicated by a CVSS 3.1 Base Score of 7.5.

Affected Systems

Oracle Corporation’s Oracle VM VirtualBox version 7.2.16 is affected.

Risk and Exploitability

The CVSS score of 7.5 reflects a high severity local attack with a scope change. The EPSS score is below 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, the requirement for human interaction and the potential for full compromise suggests that environments hosting VirtualBox should treat this as a moderate to high risk until a fix is applied.

Generated by OpenCVE AI on September 20, 2026 at 05:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle VM VirtualBox update that removes the local privilege escalation vulnerability.
  • If an immediate patch is not available, further restrict access to the VirtualBox host by limiting logon rights to trusted administrators and disabling unused features or network services.
  • Enforce network segmentation and monitor for unusual local login activity, ensuring that any user with low privileges cannot initiate VirtualBox operations that require the vulnerability.

Generated by OpenCVE AI on September 20, 2026 at 05:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 20 Sep 2026 05:45:00 +0000

Type Values Removed Values Added
Title Low-Privilege Authorization Bypass Leading to VirtualBox Takeover

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle VM VirtualBox Component Core
Weaknesses CWE-269

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Thu, 17 Sep 2026 00:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation in Oracle VM VirtualBox Component Core
Weaknesses CWE-269

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle vm Virtualbox
CPEs cpe:2.3:a:oracle:vm_virtualbox:7.2.16:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle vm Virtualbox
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Vm Virtualbox
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-22T03:55:50.336Z

Reserved: 2026-09-08T21:49:12.408Z

Link: CVE-2026-87276

cve-icon Vulnrichment

Updated: 2026-09-17T14:58:07.591Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:19:16.353

Modified: 2026-09-23T13:52:06.323

Link: CVE-2026-87276

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T05:30:16Z

Weaknesses