Oracle VirtualBox CVE-2026-71140

Exploitation requires an attacker to have physical or remote logon access to the infrastructure host where Oracle VM VirtualBox 7.2.14 executes, with high-privilege credentials (PR:H) on that host. The attack vector is strictly local (AV:L); network-based exploitation is not possible per the CVSS vector. No user interaction is required once the attacker is authenticated. The vulnerability is limited to VirtualBox 7.2.14 specifically. What limits exploitation: the requirement for high OS-level privileges substantially narrows the attacker population to administrators or those who have already achieved host compromise; scope is unchanged (S:U), so guest-to-host breakout or lateral movement to other systems is not implied by this vulnerability. The 'Authentication Bypass' tag may indicate an internal authorization bypass within the VirtualBox Core component rather than a bypass of OS-level authentication, but this is not confirmed from available data.

The aggregate risk signal here is low. The CVSS 3.1 base score of 3.4 reflects constrained impact: local vector, high-privilege prerequisite, and only partial confidentiality and integrity effects with zero availability impact. No KEV listing exists and no public exploit code has been identified, meaning exploitation has not been confirmed as active or widespread. EPSS data is absent from the provided intelligence, so exploitation probability cannot be quantified. Even a mid-sized municipal IT team in gniezno should treat this as a routine patch-cycle item rather than an emergency response trigger. The 'Authentication Bypass' tag introduces minor ambiguity - if this represents a privilege escalation path from PR:H to a broader scope, the practical impact could exceed what raw CVSS metrics suggest; however, the S:U (scope unchanged) metric argues against this. The discrepancy between the bypass tag and the PR:H/S:U vector should be noted as an unresolved signal, and organizations should consult the Oracle CPU August 2026 advisory for clarification.

An attacker who already holds a high-privilege account on the host system running VirtualBox 7.2.14 - such as a compromised administrator credential or a malicious insider - could exploit the Core component flaw to read data they are not authorized to access or make unauthorized modifications to VirtualBox-managed data stores. No public proof-of-concept exists at time of analysis, meaning exploitation requires independent vulnerability research or insider knowledge.