Skip to main content

Oracle VM VirtualBox CVE-2026-71131

| EUVDEUVD-2026-62074 HIGH
Improper Access Control (CWE-284)
2026-08-18 secalert_us@oracle.com GHSA-95v2-h58g-mm3h
Oracle Authentication Bypass Vm Virtualbox
8.6
CVSS 3.1 · Vendor: oracle
Share

Severity by source

Vendor (oracle) PRIMARY
8.6 HIGH
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
vuln.today AI
8.6 HIGH

Local vector confirmed by 'logon to infrastructure' prerequisite; PR:N because no VirtualBox-level credentials needed; UI:R and S:C explicitly stated; full CIA impact from confirmed takeover outcome.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 18, 2026 - 22:22 vuln.today
CVE Published
Aug 18, 2026 - 21:18 nvd
HIGH 8.6

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle VM VirtualBox 7.2.14 is achievable by a local, unprivileged attacker who can induce a victim user to interact with a malicious guest or crafted input, with the scope change indicator in the CVSS vector (S:C) strongly suggesting a guest-to-host boundary breach impacting the underlying infrastructure. The complete C:H/I:H/A:H impact triad confirms that successful exploitation results in total loss of confidentiality, integrity, and availability of both the VirtualBox process and potentially the host system. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must have logon access to the physical or virtual infrastructure where Oracle VM VirtualBox 7.2.14 is executing (AV:L) - this is not a remote network-exploitable vulnerability. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 8.6 (High) is driven primarily by the scope change and full CIA impact, but must be contextualized carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply Oracle's Critical Patch Update for August 2026, which addresses this vulnerability; consult the advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the specific patched version - no exact fix version number is independently confirmed in the available data beyond the CPU reference. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Audit all systems running VirtualBox 7.2.14, prioritizing those hosting untrusted or development virtual machines; restrict local access to this software to trusted administrators. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Vm Virtualbox

View all
CVE-2019-2725 CRITICAL POC
9.8 Apr 26

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
CVE-2015-0235 CRITICAL POC
10.0 Jan 28

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,

CVE-2014-0983 MEDIUM POC
6.9 Mar 31

Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/s
CVE-2017-3316 HIGH POC
8.4 Jan 27

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Rated high severity (C
CVE-2017-10129 HIGH POC
8.8 Aug 08

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2017-3576 HIGH POC
8.8 Apr 24

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2017-3561 HIGH POC
8.8 Apr 24

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2017-3563 HIGH POC
8.8 Apr 24

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2017-10204 HIGH POC
8.8 Aug 08

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2019-2721 HIGH POC
8.8 Apr 23

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2018-2698 HIGH POC
8.8 Jan 18

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2017-3558 HIGH POC
8.5 Apr 24

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-71131 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy