Oracle VM VirtualBox CVE-2026-71131

The attacker must have logon access to the physical or virtual infrastructure where Oracle VM VirtualBox 7.2.14 is executing (AV:L) - this is not a remote network-exploitable vulnerability. Human interaction from a person other than the attacker is explicitly required (UI:R); the precise interaction is unspecified in available data but is a necessary prerequisite. No VirtualBox application-level privileges are required (PR:N), meaning a guest VM user or unprivileged local user can be the attacker. Exploitation is limited to VirtualBox version 7.2.14 specifically, as stated in the Oracle CPU. Limiting factors include: mandatory local access to the host infrastructure, mandatory victim interaction, and a single affected version (7.2.14), all of which reduce opportunistic exploit surface compared to the raw CVSS score suggests.

The CVSS 3.1 base score of 8.6 (High) is driven primarily by the scope change and full CIA impact, but must be contextualized carefully. The local attack vector (AV:L) meaningfully constrains exploitability compared to network-reachable vulnerabilities - the attacker must already have logon access to the host infrastructure, limiting opportunistic mass exploitation. User interaction (UI:R) adds a further barrier, requiring a victim to perform some action (e.g., running a guest VM, opening a crafted disk image, or interacting with a shared device). No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing is present and no public proof-of-concept code has been identified, suggesting exploitation remains theoretical or limited to sophisticated actors at this time. The scope change is the most alarming signal: if this is a VM escape, the host system and any co-located VMs are at risk, amplifying blast radius beyond a single VM. Oracle tags this as 'Information Disclosure' which conflicts with the full CIA takeover CVSS impact - this discrepancy should be verified against the Oracle CPU August 2026 advisory directly. Real-world priority is moderate-to-high for multi-tenant or shared infrastructure environments running VirtualBox where guest users are semi-trusted; lower for isolated single-user desktop deployments.

An attacker with logon access to a shared server or workstation running VirtualBox 7.2.14 launches or connects to a guest VM and crafts a malicious interaction - such as a specially constructed disk image, device I/O sequence, or shared folder operation - then waits for or social-engineers a privileged user on the host to interact with the VM or trigger the vulnerable code path. Upon successful exploitation, the attacker escapes the guest VM boundary and achieves code execution within the VirtualBox host process, enabling full control of the host operating system and any co-resident VMs. No public proof-of-concept exists at time of analysis, placing this scenario currently within reach of skilled threat actors with local access rather than commodity attackers.