EUVD-2026-62080
GHSA-cq2p-8346-3p5h
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H
Local access and high privileges are required to interact with the Core hypervisor component; scope change reflects potential host or co-tenant impact consistent with description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H).
AnalysisAI
Local privilege escalation and denial-of-service in Oracle VM VirtualBox 7.2.14 allows a high-privileged attacker with local infrastructure access to crash the hypervisor, partially read or modify VM-accessible data, and - critically - extend impact beyond the vulnerable instance to additional products via a confirmed scope change. The CVSS 3.1 vector (AV:L/PR:H/S:C/A:H) indicates this is not a remote threat but a post-compromise or insider-level concern targeting the virtualization layer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires high-privileged local access (PR:H, AV:L) to the infrastructure host where Oracle VM VirtualBox 7.2.14 is executing - meaning the attacker must hold administrative or root-level credentials on that host, not merely guest OS access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.3 base score reflects a meaningful but constrained threat profile: local access (AV:L) and high privilege (PR:H) are significant barriers that substantially reduce the population of viable attackers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply Oracle's patch released as part of the August 2026 Critical Patch Update, available via https://www.oracle.com/security-alerts/cspuaug2026.html; the exact patched version number beyond 7.2.14 is not independently confirmed from available data, so administrators should consult Oracle's advisory directly for the target upgrade version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all Oracle VM VirtualBox 7.2.14 instances across infrastructure and catalog which run business-critical or multi-tenant workloads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Vm Virtualbox
View allVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/s
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Rated high severity (C
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Rated high severity (
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today