What is the CVSS score of CVE-2026-71135?

CVE-2026-71135 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Oracle VM VirtualBox CVE-2026-71135

EUVD-2026-62077 MEDIUM

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-79jc-524m-g5c6

Authentication Bypass Oracle Vm Virtualbox

6.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.0 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

6.0 MEDIUM

Local-only vector with high privileges matches host-logon requirement; scope change confirmed by Oracle description; pure availability impact only.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 03:30 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).

AnalysisAI

Oracle VM VirtualBox 7.2.14 Core component allows a high-privileged local attacker to trigger a complete denial-of-service condition - causing a hang or frequently repeatable crash of the hypervisor - with a confirmed scope change that can significantly impact additional products beyond VirtualBox itself, likely the host operating system or co-resident guest VMs. The vulnerability is exploitable by an attacker with administrator-level access already present on the host infrastructure, making it most relevant in multi-tenant or shared virtualization environments where privileged-but-not-hypervisor-owner threat actors are a realistic model. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an attacker to be locally logged on to the host infrastructure where Oracle VM VirtualBox 7.2.14 executes (AV:L), and to hold high-level privileges on that host (PR:H) - consistent with administrator or root access, not ordinary VM guest user access. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 6.0 reflects a carefully bounded risk profile: local access vector (AV:L), low complexity (AC:L), high privileges required (PR:H), no user interaction (UI:N), scope change (S:C), and high availability impact (A:H) with no confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary remediation is to apply the patch released by Oracle as part of the August 2026 Critical Patch Update (CPU), available via the Oracle security advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.