What is the CVSS score of CVE-2026-47054?

CVE-2026-47054 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle VM VirtualBox are affected by CVE-2026-47054?

Organizations using Oracle VM VirtualBox 7.2.12 on Windows face exposure to insider threats and compromised user accounts through a local privilege escalation vulnerability (CVSS 7.8) that enables…

How to fix or mitigate CVE-2026-47054?

Within 24 hours, inventory all systems running Oracle VM VirtualBox 7.2.12 on Windows and restrict host access to explicitly authorized administrators only. Within 7 days, apply compensating controls including disabling unused VirtualBox features, restricting VirtualBox.exe execution through application whitelisting, and enabling Windows audit logging for privilege escalation detection. Within 30 days, monitor Oracle's Critical Patch Update advisories for patch availability and establish a timeline to upgrade to patched versions or transition to alternative hypervisors.

Oracle VM VirtualBox CVE-2026-47054

EUVD-2026-46540 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 oracle

GHSA-pwc4-f3h4-q5vw

Oracle Microsoft Oracle Vm Virtualbox Privilege Escalation

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Requires an authenticated low-privileged local logon to the host (AV:L/PR:L), needs no user interaction at low complexity, and yields full host/VirtualBox takeover (C:H/I:H/A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:27 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Windows host only. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged attacker who can log on to the host to compromise the VirtualBox Core component with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The single vendor reference is Oracle's July 2026 Critical Patch Update advisory.

Technical ContextAI

Oracle VM VirtualBox is a cross-platform Type-2 hypervisor. The flaw resides in the 'Core' component, which brokers between guest virtual machines and the host, typically involving privileged host-side services, kernel drivers, and IPC used to manage VM lifecycle and virtualized devices on the Windows host. Because the CVSS vector is AV:L/PR:L, the weakness is reached by a user already authenticated on the host rather than from within a guest over a network. Oracle did not assign a CWE (CWE: N/A), so the precise root-cause class (e.g., improper privilege management, unsafe handling of a privileged operation, or a driver/IPC input-validation flaw) cannot be confirmed from the provided data; the CPE cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox identifies the affected application generically without a version pin.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update, which addresses this issue per https://www.oracle.com/security-alerts/cpujul2026.html; treat this as Patch available per vendor advisory and confirm the exact fixed VirtualBox build from that advisory, as an exact fixed version string was not included in the provided data (do not assume a version number). Until patched, reduce exposure by restricting interactive and remote logon rights on Windows hosts running VirtualBox to trusted administrators only (since exploitation requires a local low-privileged logon), removing VirtualBox from multi-user or shared Windows hosts where untrusted users can log on, and where feasible stopping or disabling VirtualBox host services when not actively in use - the trade-off being that these controls limit legitimate multi-user or automated VM usage on the affected host. These are compensating controls only and are not a substitute for the CPU update.