Skip to main content

Oracle VM VirtualBox CVE-2026-71132

| EUVDEUVD-2026-62075 MEDIUM
Improper Access Control (CWE-284)
2026-08-18 secalert_us@oracle.com GHSA-3329-r3wg-x666
Authentication Bypass Oracle Vm Virtualbox
5.3
CVSS 3.1 · Vendor: oracle
Share

Severity by source

Vendor (oracle) PRIMARY
5.3 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
vuln.today AI
5.3 MEDIUM

Local high-privilege access and difficult conditions required; scope change reflects cross-VM confidentiality breach with no integrity or availability impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector
Local
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Aug 19, 2026 - 03:31 vuln.today
CVE Published
Aug 18, 2026 - 21:18 nvd
MEDIUM 5.3

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Oracle VM VirtualBox 7.2.14 Core component exposes a local confidentiality vulnerability enabling a high-privileged attacker with local infrastructure access to read critical data across VM isolation boundaries, with confirmed scope change indicating potential host or cross-VM data exposure. The CVSS vector (AV:L/AC:H/PR:H/S:C/C:H/I:N/A:N) reflects a narrow but impactful attack path constrained by high complexity and privilege prerequisites. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to already possess high-privilege access (PR:H) with local logon capability on the physical or virtual infrastructure host where Oracle VM VirtualBox 7.2.14 is installed (AV:L) - this rules out remote unauthenticated exploitation entirely. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The real-world risk is moderate-low for most organizations, heavily constrained by three simultaneous prerequisites: local infrastructure access (AV:L), high attack complexity (AC:H), and high privileges (PR:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply Oracle's Critical Patch Update for August 2026, documented at https://www.oracle.com/security-alerts/cspuaug2026.html; however, an exact patched version number has not been independently confirmed from the available data - consult the full Oracle CPU advisory directly to identify the specific fixed build and upgrade path. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Vm Virtualbox

View all
CVE-2019-2725 CRITICAL POC
9.8 Apr 26

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
CVE-2015-0235 CRITICAL POC
10.0 Jan 28

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,

CVE-2014-0983 MEDIUM POC
6.9 Mar 31

Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/s
CVE-2017-3316 HIGH POC
8.4 Jan 27

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Rated high severity (C
CVE-2017-10129 HIGH POC
8.8 Aug 08

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2017-3576 HIGH POC
8.8 Apr 24

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2017-3561 HIGH POC
8.8 Apr 24

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2017-3563 HIGH POC
8.8 Apr 24

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2017-10204 HIGH POC
8.8 Aug 08

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2019-2721 HIGH POC
8.8 Apr 23

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2018-2698 HIGH POC
8.8 Jan 18

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
CVE-2017-3558 HIGH POC
8.5 Apr 24

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-71132 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy