What is the CVSS score of CVE-2026-71116?

CVE-2026-71116 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle VM VirtualBox are affected by CVE-2026-71116?

Organizations using Oracle VM VirtualBox 7.2.14 face complete loss of virtual machine isolation if privileged local users are compromised or become malicious, enabling attackers to access or modify…

How to fix or mitigate CVE-2026-71116?

Within 24 hours, inventory all systems running Oracle VM VirtualBox 7.2.14 and identify local users with high-privilege access; immediately restrict unnecessary administrative permissions and review access logs for suspicious activity. Within 7 days, implement privileged access management (PAM) controls and monitor Oracle's security advisories for patch status; assess operational feasibility of disabling VirtualBox on non-critical systems. Within 30 days, apply a vendor patch to all affected systems as soon as Oracle releases one; maintain restricted local administrative access and consider network segmentation or workload migration for critical guest VMs until remediation is available.

Oracle VM VirtualBox CVE-2026-71116

EUVD-2026-62059 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-fwfr-gjvr-4w7h

Oracle Authentication Bypass Vm Virtualbox

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Local vector and high privileges confirmed by description; AC:H reflects 'difficult to exploit' language; S:C with full C:H/I:H/A:H reflects full takeover extending to hosted guest scope.

3.1 AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:26 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full hypervisor takeover in Oracle VM VirtualBox 7.2.14 is achievable by a locally authenticated, highly privileged attacker exploiting a flaw in the Core component, with successful attacks producing a scope change that may compromise systems beyond the primary VirtualBox instance. The CVSS vector confirms local-only access with high privilege and complexity prerequisites, but the S:C scope change elevates real-world impact substantially - a compromised hypervisor exposes all hosted guest VMs and their data. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires three concurrent conditions: (1) local logon access to the host infrastructure running Oracle VM VirtualBox - the AV:L vector explicitly excludes remote exploitation; (2) high privileges on that host system (PR:H), meaning the attacker must already hold an elevated or administrative account before exploitation begins; and (3) the ability to satisfy AC:H conditions, indicating a non-trivial exploitation sequence that may depend on system state, timing, or internal configuration of the Core component. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 7.5 with vector AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H presents a nuanced risk profile: the maximum CIA impact and scope change are severe in theory, but AC:H and PR:H substantially constrain practical exploitability, limiting realistic exposure to insider threats and post-compromise escalation scenarios rather than opportunistic remote attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's Critical Security Update published in August 2026, available through the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all systems running Oracle VM VirtualBox 7.2.14 and identify local users with high-privilege access; immediately restrict unnecessary administrative permissions and review access logs for suspicious activity. …

Threat intelligence, references, and detailed analysis are available after sign-in.