Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H).
Published: 2026-09-15
Score: 4.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

Oracle VM VirtualBox version 7.2.16 contains a flaw that allows a local user with high privileges, who can rely on another person’s interaction on the same host, to force the hypervisor to crash. The vulnerability is a local capability escalation issue classified as CWE-284 and results in a complete denial of service for the VirtualBox service without granting additional privileges or affecting other system components.

Affected Systems

The product affected is Oracle VM VirtualBox version 7.2.16, supplied by Oracle Corporation. No other versions or products are listed as impacted.

Risk and Exploitability

The CVSS base score of 4.2 (AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H) indicates a low availability impact. The EPSS score is less than 1%, suggesting a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attacks require a local high‑privilege user and a human interaction from another individual, limiting the risk to environments where privileged users can influence other users on the same host. There is no known remote exploitation path or extra attack surface beyond the localized crash scenario.

Generated by OpenCVE AI on September 20, 2026 at 06:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle‑published patch or upgrade Oracle VM VirtualBox to a non‑affected version (e.g., 7.2.17 or later).
  • Restrict or monitor high‑privilege accounts that interact with VirtualBox, ensuring that only trusted users control VM instances.
  • Configure host isolation measures and disable or limit features that allow untrusted user interaction to reduce the likelihood of a successful crash.

Generated by OpenCVE AI on September 20, 2026 at 06:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 06:30:00 +0000

Type Values Removed Values Added
Title Local High‑Privilege User Can Trigger VirtualBox Crash (DoS)

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Local Privileged User Can Induce VirtualBox Crash (Denial of Service)
Weaknesses CWE-399

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 16 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Title Local Privileged User Can Induce VirtualBox Crash (Denial of Service)
Weaknesses CWE-399

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle vm Virtualbox
CPEs cpe:2.3:a:oracle:vm_virtualbox:7.2.16:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle vm Virtualbox
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Vm Virtualbox
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T15:10:37.066Z

Reserved: 2026-09-08T21:49:12.408Z

Link: CVE-2026-87280

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:19:16.790

Modified: 2026-09-23T13:51:28.363

Link: CVE-2026-87280

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T06:15:07Z

Weaknesses