What is the CVSS score of CVE-2026-71125?

CVE-2026-71125 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.1%.

Oracle VM VirtualBox CVE-2026-71125

EUVD-2026-62068 MEDIUM

Race Condition Enabling Link Following (CWE-363)

2026-08-18 secalert_us@oracle.com

GHSA-88f7-fpm5-mgvg

Denial Of Service Oracle Vm Virtualbox

6.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

vuln.today AI

6.1 MEDIUM

Local-only attack surface (AV:L), no elevated privileges needed (PR:N), but victim interaction required (UI:R); no confidentiality impact per description.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 03:32 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H).

AnalysisAI

Oracle VM VirtualBox 7.2.14 (Core component) is affected by a locally exploitable vulnerability that allows a low-privileged, unauthenticated local user to cause a complete denial of service - a hang or repeatable crash - of the hypervisor, as well as unauthorized modification of a subset of its accessible data. Exploitation requires physical or logical local access to the host infrastructure and human interaction from a separate user (e.g., a legitimate VirtualBox user performing a VM operation). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires: (1) local logon access to the physical or virtual host infrastructure where Oracle VM VirtualBox 7.2.14 is running - remote network exploitation is not possible given AV:L; (2) human interaction from a person other than the attacker, meaning a legitimate VirtualBox user must be actively using or interacting with VirtualBox at or near the time of the attack (UI:R); and (3) the affected version must be exactly 7.2.14, the only confirmed vulnerable release per the Oracle CPU. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The real-world risk of this vulnerability is moderate-to-low despite the 'easily exploitable' descriptor in the Oracle advisory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the patch provided in the Oracle Critical Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Vm Virtualbox

View all

CVE-2019-2725 CRITICAL Act Now POC

9.8 Apr 26

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr

CVE-2015-0235 CRITICAL Act Now POC

10.0 Jan 28

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,

CVE-2014-0983 MEDIUM This Month POC

6.9 Mar 31

Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/s

CVE-2017-3316 HIGH This Week POC

8.4 Jan 27

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Rated high severity (C

CVE-2017-10129 HIGH This Week POC

8.8 Aug 08