What is the CVSS score of CVE-2026-71136?

CVE-2026-71136 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle VM VirtualBox are affected by CVE-2026-71136?

Oracle VM VirtualBox 7.2.14 contains a privilege escalation vulnerability (CVE-2026-71136) that allows high-privileged local users to destabilize the hypervisor and breach isolation between co-hosted…

How to fix or mitigate CVE-2026-71136?

Within 24 hours: inventory all Oracle VM VirtualBox 7.2.14 instances and classify by workload criticality and guest access controls; immediately audit and restrict high-privilege local access to affected hosts, implementing temporary network isolation for any guest workloads requiring provisioning. Within 7 days: deploy host-level monitoring and alerting for hypervisor crashes and anomalous process activity; implement network segmentation to isolate VirtualBox host infrastructure from downstream production systems; enforce access controls requiring multi-factor authentication and time-bounded sessions for all administrative access to VirtualBox hosts. Within 30 days: monitor Oracle security advisories for patch availability and plan a staged upgrade strategy; evaluate alternative hypervisor platforms (KVM, Hyper-V) for production multi-tenant workloads to reduce dependence on VirtualBox; implement host hardening and application whitelisting to limit lateral movement from compromised VirtualBox instances.

Oracle VM VirtualBox CVE-2026-71136

EUVD-2026-62078 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-vwr9-8r43-m9gr

Authentication Bypass Oracle Vm Virtualbox

7.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.3 HIGH

AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H

vuln.today AI

7.3 HIGH

Local attack vector and high privileges confirmed by description; scope change reflects hypervisor boundary impact; availability is primary impact with minor C and I.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:21 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.3

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).

AnalysisAI

Local privilege escalation with scope change in Oracle VM VirtualBox 7.2.14 allows a high-privileged local attacker to crash the hypervisor repeatedly, modify limited guest data, and read a subset of accessible data - with impacts that extend beyond the VirtualBox process to additional co-hosted products. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an attacker to already hold a high-privileged account (PR:H) with local logon access to the infrastructure where Oracle VM VirtualBox 7.2.14 executes. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.3 reflects a meaningful but bounded threat: local access (AV:L) and high privilege requirements (PR:H) significantly reduce the attack surface compared to a remotely exploitable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary remediation is to apply the patch released by Oracle as part of the August 2026 Critical Patch Update, available via the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: inventory all Oracle VM VirtualBox 7.2.14 instances and classify by workload criticality and guest access controls; immediately audit and restrict high-privilege local access to affected hosts, implementing temporary network isolation for any guest workloads requiring provisioning. …

Threat intelligence, references, and detailed analysis are available after sign-in.