What is the CVSS score of CVE-2026-71126?

CVE-2026-71126 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle VM VirtualBox are affected by CVE-2026-71126?

Oracle VM VirtualBox 7.2.14 contains a high-severity hypervisor escape vulnerability (CVE-2026-71126) that could enable any user with local system access to achieve complete compromise of the host…

How to fix or mitigate CVE-2026-71126?

Within 24 hours, inventory all systems running Oracle VM VirtualBox 7.2.14 and restrict local system access to trusted personnel only; disable or isolate any affected instances processing untrusted workloads. Within 7 days, monitor Oracle security advisories for patch availability and identify alternative hypervisors (KVM, Hyper-V) as contingency options; if Oracle releases a patch, begin testing in non-production environments immediately. Within 30 days, migrate all affected VirtualBox 7.2.14 instances to a patched version if Oracle releases one, or alternatively decommission affected systems and transition workloads to alternative hypervisors; implement continuous monitoring for anomalous activity on remaining systems and formally document all compensating controls.

Oracle VM VirtualBox CVE-2026-71126

EUVD-2026-62069 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-6j9m-87jh-7j98

Oracle Authentication Bypass Vm Virtualbox

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector and low-privilege requirement confirmed by description; high complexity reflects difficult conditions; scope change captures VM-to-host boundary crossing with full host impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:24 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle VM VirtualBox 7.2.14 is achievable by a low-privileged local attacker through a high-complexity exploit targeting the Core component, with successful attacks crossing the VM boundary to significantly impact the host and potentially co-hosted workloads. The scope change indicated in the CVSS vector (S:C) is consistent with a VM escape class of vulnerability, making this critical in shared or multi-tenant infrastructure despite the local access prerequisite. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an active logon session to the infrastructure where Oracle VM VirtualBox 7.2.14 is running, specifically as a low-privileged user (confirmed by CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.8 represents genuine high severity: the scope change and full CIA impact are consistent with VM escape scenarios that can expose host-level secrets, disrupt all co-hosted VMs, and enable persistent attacker presence on the hypervisor host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's August 2026 Critical Security Update for VirtualBox by upgrading from 7.2.14 to the patched release specified in the official advisory at https://www.oracle.com/security-alerts/cspuaug2026.html; the exact patched version number is not independently confirmed from the available intelligence and must be verified directly from the Oracle advisory before deployment. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all systems running Oracle VM VirtualBox 7.2.14 and restrict local system access to trusted personnel only; disable or isolate any affected instances processing untrusted workloads. …

Threat intelligence, references, and detailed analysis are available after sign-in.