What is the CVSS score of CVE-2026-71141?

CVE-2026-71141 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of Oracle VM VirtualBox are affected by CVE-2026-71141?

Oracle VM VirtualBox 7.2.14 contains a scope-changing integrity vulnerability (CVSS 7.7) that allows local attackers to break VM containment and compromise the hypervisor host system and co-resident…

How to fix or mitigate CVE-2026-71141?

Within 24 hours, inventory all Oracle VM VirtualBox 7.2.14 deployments and categorize systems by workload sensitivity and multi-tenancy posture. Within 7 days, implement access controls by restricting logon and administrative access to hypervisor hosts to authorized personnel only, disable VirtualBox on non-essential systems, and segment production VMs to dedicated hypervisors where feasible. Within 30 days, monitor Oracle's security advisories for the Critical Security Patch Update and apply it immediately upon release; until patching is available, consider migration of business-critical workloads to alternative virtualization platforms with available security updates.

Oracle VM VirtualBox CVE-2026-71141

EUVD-2026-62083 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-4p6h-mrrx-4qc2

Denial Of Service Oracle Authentication Bypass Vm Virtualbox

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L

vuln.today AI

7.7 HIGH

Local infrastructure logon required (AV:L), no privileges needed (PR:N), third-party user interaction required (UI:R), and scope change to host or sibling VMs (S:C) with high integrity and partial confidentiality/availability impacts match the Oracle-provided description exactly.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:21 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L).

AnalysisAI

Oracle VM VirtualBox 7.2.14 Core component exposes a scope-changing integrity vulnerability that allows a local unauthenticated attacker - with logon access to the infrastructure hosting the hypervisor - to critically compromise VirtualBox data when a legitimate third party interacts with the product. The attack vector is local and requires human interaction, but the CVSS scope change (S:C) indicates that a successful exploit can break VM containment and significantly impact the host system or co-resident components beyond VirtualBox itself. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The attacker must have logon access (local session) to the physical or virtual infrastructure where Oracle VM VirtualBox 7.2.14 is executing - this is the primary gate enforced by AV:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.7 (High) is driven primarily by the scope change and high integrity impact rather than broad attack surface, since AV:L constrains exposure to actors with local infrastructure access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's August 2026 Critical Security Patch Update, available through the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.