What is the CVSS score of CVE-2025-62587?

CVE-2025-62587 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2025-62587?

Within 24 hours, inventory all hosts running Oracle VM VirtualBox 7.1.12 or 7.2.2, verify that administrative access is restricted to essential personnel, and enable logging to detect anomalous VirtualBox process behavior. Within 7 days, implement least privilege by removing unnecessary local admin rights, consider isolating or temporarily disabling VirtualBox on high-value hosts, and monitor Oracle's advisory channels for a patch release. Within 30 days, develop a patch deployment plan for when a vendor fix becomes available, conduct a review of privileged account usage on virtualization hosts, and assess whether additional host-based monitoring or endpoint detection controls can alert on exploitation attempts.

Oracle VM VirtualBox CVE-2025-62587

HIGH

Privilege Defined With Unsafe Actions (CWE-267)

2025-10-21 secalert_us@oracle.com

Information Disclosure Oracle Vm Virtualbox

8.2

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain high-privileged logon on host
Exploit

Invoke flawed Core privilege operation
Execution

Escape VirtualBox privilege boundary
Impact

Compromise hypervisor and adjacent products

Vulnerability Assessment

Weakness	CWE CWE-267 ASVS 5.0 V8 - Authorization Privilege defined with unsafe actions
Exploitation Conditions	Requires the attacker to already have a high-privileged logon (PR:H) on the host infrastructure where Oracle VM VirtualBox executes - this is a local privilege/sandbox-boundary abuse, not a remote or guest-to-host-from-unprivileged vector per the stated CVSS. Affected configurations are specifically VirtualBox versions 7.1.12 and 7.2.2; no end-user interaction is needed (UI:N). The dominant limiting factors are the mandatory pre-existing high privilege level and the requirement for local access, which together substantially narrow realistic exploitation to insiders or attackers who have already compromised a privileged account on the host.
Impact	This is a genuine but second-tier priority - high CVSS (8.2) driven largely by the scope change (S:C) and full CIA impact, not by ease of reach. The CVSS vector itself tempers the score: AV:L requires local logon to the host where VirtualBox runs, and PR:H means the attacker must ALREADY hold high privileges on that host, so this is a privilege/scope-escalation primitive rather than a remote entry point. Multi-source signals agree on low real-world urgency: EPSS is only 0.20% (9th percentile), there is no CISA KEV listing, and no public POC was identified. CWE-267 (privilege defined with unsafe actions) is consistent with the description's 'high privileged attacker' prerequisite. No signals conflict - every source (CVSS PR:H, low EPSS, no KEV/POC) points the same direction: a legitimately severe sandbox-escape/takeover bug that is hard to reach and not currently being exploited at scale. The one caveat: the 'Information Disclosure' tag understates the actual impact, which per the description is full takeover of VirtualBox (C:H/I:H/A:H) with impact on additional products.
Exploit ScenarioDerived	An attacker who has already obtained high-privileged access on a host running Oracle VM VirtualBox (7.1.12 or 7.2.2) abuses a flaw in the Core component to escape the intended privilege boundary and compromise the hypervisor, with the scope change (S:C) allowing impact to extend beyond VirtualBox to other products on the host. Because AV:L/AC:L apply, exploitation is straightforward once that local high-privilege foothold exists, but it is not remotely reachable. No public exploit code was identified at the time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 08, 2026

Local privilege abuse in Oracle VM VirtualBox 7.1.12 and 7.2.2 allows an attacker who already holds a high-privileged logon (PR:H) on the host running the hypervisor to compromise the VirtualBox process and, because of the scope change (S:C), extend impact to other products on that host - resulting in full confidentiality, integrity, and availability loss within the affected security authority (CVSS 3.1 base 8.2, vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Exploitation is local-only with no user interaction and low attack complexity, but it is gated by the requirement that the attacker already be an administrator-level user on the virtualization host, which limits realistic exposure to insiders or attackers who have already compromised a privileged host account. Risk context: confirmed actively exploited is not applicable (not in CISA KEV) and no public exploit code has been identified; EPSS is 0.20% (9th percentile), indicating low near-term exploitation likelihood despite the elevated base score.

RemediationAI

Primary fix: apply the Oracle VM VirtualBox update released with the October 2025 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2025.html) - this is the vendor-released patch for the affected 7.1.12 and 7.2.2 builds, and the advisory is the authoritative source for the exact fixed build numbers to install in each branch (patch status: patch available per vendor advisory). Because the prerequisite is a high-privileged local logon, the highest-value compensating control is to restrict and audit interactive logon and administrator/root group membership on every host where VirtualBox runs, treating the host as a trust boundary: if an attacker cannot obtain the required PR:H account, the vector is not reachable, at the cost of tighter operational access workflows. Where patching must be deferred, reduce the attack surface by running VirtualBox only on dedicated single-purpose hosts not shared with sensitive workloads (the S:C impact means co-located products on the same host are in scope), and by disabling VirtualBox features that are not required - such as bridged/host-only networking, shared folders, and remote display - understanding that this restricts functionality and does not fully mitigate a PR:H attacker. Do not rely on guest-side hardening, as the assessed vector is a local host-boundary issue rather than an unprivileged guest escape; prioritize patching on multi-tenant or jump hosts where privileged accounts are numerous, and enable host logging/monitoring of privileged sessions to detect post-exploitation activity.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw sits in the Core component of Oracle VM VirtualBox, Oracle's hosted hypervisor, and is classified as CWE-267 (Privilege Defined With Unsafe Actions): the code path grants or relies on a privilege whose holder can then perform operations that are insufficiently validated, letting a high-privileged local user manipulate the VirtualBox process in ways that escape its intended boundary. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H describes the exact technical shape of the issue - access is local (AV:L), no privileges are needed beyond the mandatory high-privileged logon (PR:H), no victim interaction is required (UI:N), and exploitation complexity is low (AC:L). The scope change (S:C) is significant: although the vulnerable code lives in VirtualBox, the assessed impact crosses the component's own security authority and can affect other products on the same host, meaning the virtualization boundary itself is what is being defeated rather than a single application feature. Affected binaries are the 7.1.12 and 7.2.2 builds identified by CPE cpe:2.3:a:oracle:vm_virtualbox:7.1.12 and cpe:2.3:a:oracle:vm_virtualbox:7.2.2. It is not a remote vector and, per the assessed vector, not an unprivileged guest-to-host escape; the dominant conditions are local access plus pre-existing administrative privilege on the host.

Know when Vm Virtualbox gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 8.2 HIGH

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI 8.2 HIGH

Local host access with pre-existing high privilege gives AV:L/PR:H; low complexity (AC:L), no interaction (UI:N), and host takeover affecting other products yields S:C with full C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle VM VirtualBox 7.1.12 and 7.2.2 are affected by a high-severity local privilege escalation vulnerability that enables an attacker with existing administrative access on a host to compromise the hypervisor and extend impact to other products on that host. Exploitation requires high-privileged local authentication and no public exploit has been identified at time of analysis, but successful attacks could result in full loss of confidentiality, integrity, and availability for affected systems. Leadership should focus on tightening administrative access controls and preparing for a vendor patch to mitigate insider or compromised-account risks.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include restricting administrative access to hosts running Oracle VM VirtualBox 7.1.12 and 7.2.2, monitoring for suspicious process behavior, and isolating or temporarily disabling VirtualBox where feasible.

Threat Intelligence Overview

EPSS Score

0.2%

Top 91% exploitable

Prevalence

High

very widely deployed free desktop and developer virtualization software

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +41

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.