CVE-2026-87282

Published Sep 15, 2026 CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).

Analysis

Technical impact

The flaw resides in the Core component of Oracle VM VirtualBox and can be triggered by a local user with high privileges, causing the hypervisor to hang or crash, which results in a complete denial of service that affects the availability of virtual machines and any applications running inside them. The bug is a classic denial‑of‑service condition arising from improper resource management (CWE‑400). The potential impact is limited to availability; confidentiality and integrity are not affected.

Affected Systems

Oracle VM VirtualBox version 7.2.16 is listed as the affected release by the vendor; no other versions are explicitly marked as vulnerable in this CVE.

Risk and Exploitability

The CVSS base score of 6.0 indicates a moderate security impact focusing on availability, and the vector description (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) shows that the vulnerability requires local, authenticated access with high privileges. Based on the description, it is inferred that the attack vector is local. The EPSS score of less than 1% suggests that the problem is unlikely to be widely exploited at present, and the vulnerability is not in CISA’s KEV catalog. However, if a host is already compromised or an administrator account is abused, the flaw can be exercised with minimal effort, making the risk high for locally privileged systems.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle VM VirtualBox

affected

Version	Status	Constraints
`7.2.16`	affected	—

Configuration 1 [-]

cpe:2.3:a:oracle:vm_virtualbox:7.2.16:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Vm Virtualbox

Version	Status	Scheme	Platform
`7.2.16`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply any available vendor patch for VirtualBox or upgrade to a non‑vulnerable release.
Restrict local administrator privileges on hosts that run VirtualBox to reduce the attack surface.
Monitor VirtualBox logs for hangs or crashes and isolate affected machines; if a fix is not available, uninstall VirtualBox on exposed systems until the vulnerability is remediated.

Generated by OpenCVE AI on September 21, 2026 at 17:41 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.165% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.oracle.com/security-alerts/cspusep2026.html

History

Sep 21, 2026 6:00 PM Title updated View changes

Type	Values Removed	Values Added
Title	Local Privileged Denial of Service in Oracle VM VirtualBox 7.2.16

Sep 21, 2026 3:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-284	CWE-400
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 20, 2026 6:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		Local Privileged Denial of Service in Oracle VM VirtualBox 7.2.16

Sep 18, 2026 9:30 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Denial of Service in Oracle VM VirtualBox 7.2.16
Weaknesses	CWE-400

Sep 17, 2026 4:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-284

Sep 16, 2026 5:30 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Denial of Service in Oracle VM VirtualBox 7.2.16
Weaknesses		CWE-400

Sep 15, 2026 8:15 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).
First Time appeared		Oracle Oracle vm Virtualbox
CPEs		cpe:2.3:a:oracle:vm_virtualbox:7.2.16:::::::*
Vendors & Products		Oracle Oracle vm Virtualbox
References		https://www.oracle.com/security-alerts/cspusep2026.html
Metrics		cvssV3_1 `{'score': 6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H'}`