What is the CVSS score of CVE-2026-71129?

CVE-2026-71129 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle VM VirtualBox are affected by CVE-2026-71129?

Oracle VM VirtualBox 7.2.14 contains a high-severity vulnerability enabling complete infrastructure compromise by privileged insiders or compromised administrator accounts.

How to fix or mitigate CVE-2026-71129?

Within 24 hours, identify and inventory all systems running Oracle VM VirtualBox 7.2.14 in production and development environments, noting their role and criticality. Within 7 days, restrict administrative access to VirtualBox management interfaces to essential personnel only, enforce multi-factor authentication for privileged accounts, and implement detailed logging of all administrative activities. Within 30 days, monitor Oracle's published security bulletins for patch availability and deploy the patched version as soon as the vendor releases it.

Oracle VM VirtualBox CVE-2026-71129

EUVD-2026-62072 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-95h3-mgh7-w8wc

Oracle Authentication Bypass Vm Virtualbox

8.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.2 HIGH

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Local vector and high privileges confirmed by description; scope change reflects cross-boundary impact; full C/I/A consistent with 'takeover' language.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:23 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 8.2

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle VM VirtualBox 7.2.14 is achievable by a locally-authenticated, high-privileged attacker, with confirmed scope change indicating the compromise extends beyond the hypervisor to additional products - consistent with a VM escape or host privilege escalation pattern. The CVSS vector (AV:L/PR:H/S:C/C:H/I:H/A:H) signals that despite the elevated privilege bar, successful exploitation yields complete confidentiality, integrity, and availability impact across system boundaries. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to have already obtained high-privileged (administrator-level) access on the physical or virtual infrastructure where Oracle VM VirtualBox 7.2.14 is installed and executing - the CVSS PR:H metric confirms this. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Raw CVSS score of 8.2 places this in the High severity band, but the real-world priority depends on several nuancing factors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary remediation is to apply the patch released via Oracle's August 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and inventory all systems running Oracle VM VirtualBox 7.2.14 in production and development environments, noting their role and criticality. …

Threat intelligence, references, and detailed analysis are available after sign-in.