What is the CVSS score of CVE-2026-71114?

CVE-2026-71114 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Oracle VM VirtualBox CVE-2026-71114

EUVD-2026-62057 MEDIUM

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-rv8v-5577-rf35

Authentication Bypass Oracle Vm Virtualbox

6.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.0 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.0 MEDIUM

Local logon and high-privilege requirement confirmed by description; scope change reflects cross-VM data exposure; confidentiality-only impact with no integrity or availability consequences.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 03:35 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

MEDIUM 6.0

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Confidentiality compromise in Oracle VM VirtualBox 7.2.14 Core component allows a locally authenticated, high-privileged attacker to access all data reachable by the VirtualBox process and breach isolation boundaries to impact additional products via scope change. The 'Authentication Bypass' tag supplied by the reporter suggests an internal access-control bypass within VirtualBox's security model that extends an attacker's data reach beyond their normally authorized scope. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires two concrete prerequisites: (1) local logon access to the physical or virtual host infrastructure where Oracle VM VirtualBox 7.2.14 is executing, and (2) high-privilege credentials on that host (confirmed by CVSS PR:H). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 6.0 correctly reflects the constrained attack surface: local access (AV:L) and high-privilege prerequisite (PR:H) substantially limit who can attempt exploitation, and the impact is bounded to confidentiality (C:H, I:N, A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Oracle addressed this vulnerability in the August 2026 Critical Patch Update; consult the advisory at https://www.oracle.com/security-alerts/cspuaug2026.html to identify the specific patched release and apply the upgrade from version 7.2.14 as the primary remediation action. … Detailed patch versions, workarounds, and compensating controls in full report.