What is the CVSS score of CVE-2026-71134?

CVE-2026-71134 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Oracle VM VirtualBox CVE-2026-71134

EUVD-2026-62076 MEDIUM

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-3gjw-9g34-2cwh

Authentication Bypass Denial Of Service Oracle Vm Virtualbox

5.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

vuln.today AI

5.7 MEDIUM

Local vector and high privilege confirmed by description; scope change and low CIA impacts align precisely with Oracle's own published vector.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 03:30 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

MEDIUM 5.7

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L).

AnalysisAI

Oracle VM VirtualBox 7.2.14 contains a locally exploitable flaw in its Core component that grants high-privileged local attackers partial read, write, and denial-of-service capabilities, with a confirmed scope change meaning the impact can extend to products or components beyond VirtualBox itself. The vulnerability is described as 'easily exploitable' by Oracle, though the high privilege and local access requirements substantially constrain the realistic attacker pool. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to have high-privileged access (PR:H) with a local logon session on the infrastructure where Oracle VM VirtualBox executes (AV:L) - meaning a physical or remote shell session with administrative or equivalent OS-level privileges on the host. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 5.7 (Medium) reflects a balanced set of signals: local attack vector and high privilege requirement significantly limit exploitability, while the scope change elevates the potential blast radius. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Oracle's August 2026 Critical Security Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html) addresses this vulnerability; users should consult that advisory for the specific patched version and apply the update as directed by Oracle. … Detailed patch versions, workarounds, and compensating controls in full report.