Oracle VM VirtualBox CVE-2026-71130

Exploitation requires Oracle VM VirtualBox 7.2.14 to be running on the target host with the Virtual Remote Desktop Extension (VRDE) explicitly enabled on at least one active VM - VRDE is disabled by default for new VMs and must be manually activated per VM, meaning this is a non-default configuration. The attacker must have network-level access to the VRDE listening port on the VirtualBox host. No authentication, user interaction, session token, or pre-existing access of any kind is required beyond network reachability. Exploitation scope is limited to data accessible within the VirtualBox session (guest VM data, shared resources); it does not inherently escalate to host OS access due to unchanged scope (S:U). Environments where VRDE is disabled are not affected by this vulnerability.

The CVSS 8.2 base score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) accurately reflects a high-severity, easily automatable threat: unauthenticated, network-accessible, with no user interaction required and a high confidentiality impact. The Authentication Bypass tag is fully consistent with the PR:N metric and the described impact. EPSS data is absent from the provided intelligence, and the CVE has not been listed on the CISA KEV catalog, meaning confirmed active exploitation is not yet established - however, the trivially low attack complexity means exploit development effort would be minimal, and the risk of weaponization escalating post-publication is real. No conflicting signals exist between the CVSS vector and the description - both point to a remote, zero-auth RDP attack. Scope is unchanged (S:U), meaning the impact is bounded to VirtualBox-accessible data rather than the host OS, which provides some containment. Still, even a mid-sized municipal IT team in mielec running VirtualBox-based lab or training infrastructure with VRDE exposed should treat this as urgent patching work, given the potential for bulk scanning and automated exploitation of the RDP surface. The non-default requirement for VRDE to be enabled is the primary real-world limiting factor.

An unauthenticated attacker on the network sends crafted RDP protocol messages to the VRDE port of a host running Oracle VM VirtualBox 7.2.14 with remote display enabled on a running VM. The authentication bypass flaw in the Core component allows the attacker to establish a full RDP session without valid credentials, gaining complete read access to all data visible within the VirtualBox session - including guest VM screen output, clipboard content, and shared folder data - along with the ability to perform limited data writes. No public exploit code has been identified at time of analysis, but the network-reachable, zero-authentication attack surface is well-suited to automated scanning and exploitation tooling.