What is the CVSS score of CVE-2026-47047?

CVE-2026-47047 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle VM VirtualBox are affected by CVE-2026-47047?

Oracle VM VirtualBox 7.2.12 contains a local privilege escalation vulnerability enabling authenticated users with logon access to host systems to achieve complete compromise of VirtualBox instances…

How to fix or mitigate CVE-2026-47047?

Within 24 hours, inventory all systems running VirtualBox 7.2.12 or earlier and identify which permit low-privileged user logon sessions; prioritize instances hosting critical or sensitive workloads. Within 7 days, implement strict host-level access controls restricting logon privileges to administrators only, activate monitoring on VirtualBox processes for unauthorized access patterns, and isolate production VirtualBox hosts from networks containing low-trust user populations. Within 30 days, monitor Oracle's security advisories for patch release; until patched, plan migration of critical virtual machines to alternative hypervisor platforms or to patched VirtualBox versions when available from vendor.

Oracle VM VirtualBox CVE-2026-47047

EUVD-2026-46533 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 oracle

GHSA-97qm-242g-q522

Oracle Oracle Vm Virtualbox Privilege Escalation

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Requires an existing low-privileged local logon (AV:L, PR:L) with no user interaction and low complexity, yielding full takeover, so C/I/A all High.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:28 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged attacker with a logon session on the host where VirtualBox runs to fully compromise the VirtualBox instance, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. It was disclosed by Oracle in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle VM VirtualBox is a widely used cross-platform type-2 hypervisor; the affected 'Core' component covers the hypervisor engine and privileged host-side services (VBoxSVC, kernel drivers, and IPC surfaces) that mediate between guest VMs and the host. Vulnerabilities in this component typically stem from the trust boundary between an unprivileged local user or guest context and the higher-privileged host process, class flaws such as improper input validation, memory corruption, or insecure privilege handling. No CWE was assigned in the input, so the exact root-cause class cannot be confirmed; the CPE 'cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:*' identifies the product but is wildcarded on version, while the description pins the affected release to 7.2.12.

RemediationAI

Apply the fix delivered in Oracle's July 2026 Critical Patch Update by upgrading to the patched VirtualBox release listed at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory; an exact fixed version number is not stated in the provided data, so consult the advisory for the precise build). Until patched, reduce exposure by restricting interactive/logon access to hosts running VirtualBox to trusted administrators only, since exploitation requires a local low-privileged session; avoid running untrusted workloads or granting shell access on VirtualBox hosts, and shut down or isolate non-essential VMs. These access-restriction controls trade off multi-user convenience and shared-host usability but directly remove the local foothold the attack depends on.