CVE-2026-87284

VirtualBox 7.2.16 Local Privilege Exploit Causes Partial Denial of Service

Published Sep 15, 2026 CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 3.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L).

Analysis

Technical impact

The flaw resides in the core component of Oracle VM VirtualBox 7.2.16, allowing a local attacker with high privileges to execute actions that lead to a partial denial of service. The vulnerability is easily exploitable and can be leveraged by an attacker who has already logged into the host system.

Affected Systems

The affected product is Oracle VM VirtualBox from Oracle Corporation, version 7.2.16. The vulnerability may also affect other products that depend on VirtualBox, as indicated by the scope change, but only this specific version is listed as impacted.

Risk and Exploitability

The CVSS v3.1 base score is 3.2, focusing on availability, with an attack vector of local, low complexity, and high privileges required. The EPSS score is less than 1%, suggesting a low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are documented. Since the impact is a partial denial of service, the risk is moderate but still worth addressing to prevent potential downtime.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle VM VirtualBox

affected

Version	Status	Constraints
`7.2.16`	affected	—

Configuration 1 [-]

cpe:2.3:a:oracle:vm_virtualbox:7.2.16:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Vm Virtualbox

Version	Status	Scheme	Platform
`7.2.16`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Oracle VM VirtualBox to a patched version (e.g., 7.2.17 or newer) that resolves the core component flaw.
Ensure that only trusted users have high privileges on hosts running VirtualBox; apply least‑privilege controls and monitoring to detect anomalous activity.
If an upgraded version cannot be applied immediately, consider disabling or removing VirtualBox from the affected infrastructure until a fix is applied.

Generated by OpenCVE AI on September 20, 2026 at 05:21 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.154% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.oracle.com/security-alerts/cspusep2026.html

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 20, 2026 5:45 AM Title updated View changes

Type	Values Removed	Values Added
Title		VirtualBox 7.2.16 Local Privilege Exploit Causes Partial Denial of Service

Sep 18, 2026 9:30 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Privilege Escalation Allowing Partial Denial of Service in Oracle VM VirtualBox 7.2.16
Weaknesses	CWE-288

Sep 17, 2026 4:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-284

Sep 16, 2026 2:45 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Privilege Escalation Allowing Partial Denial of Service in Oracle VM VirtualBox 7.2.16
Weaknesses		CWE-288

Sep 15, 2026 8:15 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 3.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L).
First Time appeared		Oracle Oracle vm Virtualbox
CPEs		cpe:2.3:a:oracle:vm_virtualbox:7.2.16:::::::*
Vendors & Products		Oracle Oracle vm Virtualbox
References		https://www.oracle.com/security-alerts/cspusep2026.html
Metrics		cvssV3_1 `{'score': 3.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L'}`