CVE-2026-87285

Published Sep 15, 2026 CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).

Analysis

Technical impact

A privileged local attacker with high privileged access on a host running Oracle VM VirtualBox can exploit a flaw in the Core component to force the VirtualBox process to hang or crash. This vulnerability, classified as CWE-400, is easily exploitable and results in a complete denial of service by disrupting the availability of the VirtualBox service.

Affected Systems

The flaw affects Oracle VM VirtualBox version 7.2.16. No other specific product versions are listed, but the CVE notes that a scope change may impact additional related products.

Risk and Exploitability

The CVSS score of 6.0 reflects a moderate severity of the availability impact. The EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because the attacker requires high privileged local access and the vector is local, the exploitation likelihood depends on the security of the deployment environment rather than on network exposure.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle VM VirtualBox

affected

Version	Status	Constraints
`7.2.16`	affected	—

Configuration 1 [-]

cpe:2.3:a:oracle:vm_virtualbox:7.2.16:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Vm Virtualbox

Version	Status	Scheme	Platform
`7.2.16`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Oracle VM VirtualBox to a patched version that addresses this vulnerability.
If a patch is not yet available, remove or disable VirtualBox from the infrastructure or isolate the host and enforce strict least‑privilege controls for users with local access.
Monitor the host for abnormal hangs or crashes and alert on repeated service interruptions.

Generated by OpenCVE AI on September 21, 2026 at 16:37 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.165% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.oracle.com/security-alerts/cspusep2026.html

History

Sep 21, 2026 5:00 PM Title updated View changes

Type	Values Removed	Values Added
Title	Denial-of-Service via Improper Access Control in Oracle VM VirtualBox 7.2.16

Sep 21, 2026 3:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-284	CWE-400
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 20, 2026 5:45 AM Title updated View changes

Type	Values Removed	Values Added
Title		Denial-of-Service via Improper Access Control in Oracle VM VirtualBox 7.2.16

Sep 18, 2026 9:30 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Denial of Service via Privileged Local Attacker in Oracle VM VirtualBox 7.2.16
Weaknesses	CWE-400

Sep 17, 2026 4:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-284

Sep 16, 2026 3:30 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Denial of Service via Privileged Local Attacker in Oracle VM VirtualBox 7.2.16
Weaknesses		CWE-400

Sep 15, 2026 8:15 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).
First Time appeared		Oracle Oracle vm Virtualbox
CPEs		cpe:2.3:a:oracle:vm_virtualbox:7.2.16:::::::*
Vendors & Products		Oracle Oracle vm Virtualbox
References		https://www.oracle.com/security-alerts/cspusep2026.html
Metrics		cvssV3_1 `{'score': 6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H'}`