What is the CVSS score of CVE-2026-71140?

CVE-2026-71140 has a CVSS 3.1 base score of 3.4 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Oracle VirtualBox CVE-2026-71140

EUVD-2026-62082 LOW

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-c2j3-hh68-69r9

Authentication Bypass Oracle Vm Virtualbox

3.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.4 LOW

AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

3.4 LOW

Local-only attack vector and high-privilege requirement confirmed by description; partial C and I impact with no availability effect aligns with stated data read/write scope.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 03:20 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

LOW 3.4

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).

AnalysisAI

Oracle VM VirtualBox 7.2.14 (Core component) exposes a low-severity local vulnerability that permits a high-privileged attacker with logon access to the host infrastructure to perform unauthorized read and limited write operations against a subset of VirtualBox-accessible data. Confidentiality and integrity are partially affected; availability is not impacted. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an attacker to have physical or remote logon access to the infrastructure host where Oracle VM VirtualBox 7.2.14 executes, with high-privilege credentials (PR:H) on that host. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The aggregate risk signal here is low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary remediation is to apply the Oracle Critical Security Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.