CVE-2026-87279

Local Low‑Privilege Denial of Service and Integrity Compromise via Vulnerable Core Component in Oracle VM VirtualBox 7.2.16

View on CVE.org

Published Sep 15, 2026 CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H).

Analysis

Technical impact

A flaw in the Core component of Oracle VM VirtualBox 7.2.16 allows an attacker who is already logged on with low privileges to trigger a repeating cause a hang or frequently repeatable crash of VirtualBox, as well as unauthorized update, insert or delete access to some of VirtualBox accessible data. The vulnerability presents integrity and availability impacts, reflected in a CVSS Base Score of 6.1. The weakness is CWE-400.

Affected Systems

Oracle VM VirtualBox 7.2.16 running on any host where the user has low privileges and can log on to the infrastructure where VirtualBox executes.

Risk and Exploitability

The CVSS score indicates moderate risk. The EPSS score of < 1% suggests a very low probability of exploitation at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog access, but any logged‑on user with low‑privileged access can exploit this flaw through arbitrary operations within the VirtualBox process.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle VM VirtualBox

affected

Version	Status	Constraints
`7.2.16`	affected	—

Configuration 1 [-]

cpe:2.3:a:oracle:vm_virtualbox:7.2.16:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Vm Virtualbox

Version	Status	Scheme	Platform
`7.2.16`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Oracle security patch or upgrade that addresses the core component flaw in VirtualBox 7.2.16 or upgrade to a newer supported version.
Restrict local user accounts on hosts running VirtualBox to administrators or explicitly authorized users to limit low‑privileged access.
Configure file system permissions or access control lists on VirtualBox configuration files to prevent unauthorized modification by non‑admin users.

Generated by OpenCVE AI on September 22, 2026 at 18:08 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.152% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.oracle.com/security-alerts/cspusep2026.html

History

Sep 22, 2026 6:30 PM Title updated View changes

Type	Values Removed	Values Added
Title		Local Low‑Privilege Denial of Service and Integrity Compromise via Vulnerable Core Component in Oracle VM VirtualBox 7.2.16

Sep 22, 2026 4:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-284

Sep 21, 2026 5:30 PM Title updated View changes

Type	Values Removed	Values Added
Title	Local Privileged User Can Cause VM Crash and Alter Data in VirtualBox 7.2.16

Sep 21, 2026 3:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-400
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 20, 2026 5:45 AM Title updated View changes

Type	Values Removed	Values Added
Title		Local Privileged User Can Cause VM Crash and Alter Data in VirtualBox 7.2.16

Sep 18, 2026 9:30 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Local Privilege Exploit Causing Denial of Service and Data Modification in Oracle VM VirtualBox 7.2.16
Weaknesses	CWE-862

Sep 17, 2026 4:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-284

Sep 17, 2026 1:15 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Local Privilege Exploit Causing Denial of Service and Data Modification in Oracle VM VirtualBox 7.2.16
Weaknesses		CWE-862

Sep 15, 2026 8:15 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H).
First Time appeared		Oracle Oracle vm Virtualbox
CPEs		cpe:2.3:a:oracle:vm_virtualbox:7.2.16:::::::*
Vendors & Products		Oracle Oracle vm Virtualbox
References		https://www.oracle.com/security-alerts/cspusep2026.html
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'}`