Oracle VM VirtualBox CVE-2026-87322

Exploitation requires the attacker to (1) already hold HIGH privileges (PR:H) and (2) have access to the physical communication segment attached to the hardware running Oracle VM VirtualBox - i.e. adjacent-network positioning (AV:A), NOT internet-facing remote access. The affected target is specifically Oracle VM VirtualBox 7.2.20, component Core. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the dual requirement of local privilege and adjacent physical-segment access are the principal limiting factors; the Scope:Changed flag indicates a successful attack can cross the virtualization boundary to impact additional products/the host.

The input provides a strong CVSS 3.1 signal (8.4, CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) but NO corroborating exploitation-probability signals: EPSS is not supplied, there is no CISA KEV listing, no POC indicator, and no SSVC decision data - so no public exploit is identified at time of analysis. The CVSS vector itself is internally consistent but contains a notable tension: AV:A (adjacent) combined with Oracle's own wording 'access to the physical communication segment attached to the hardware' means the attacker is not remote over the internet but must already sit on the same physical/adjacent network segment as the VirtualBox host, and PR:H means they must additionally hold high privileges - two meaningful barriers that pull real-world risk below what the 8.4 base score suggests in isolation. The Scope:Changed flag and full C:H/I:H/A:H with 'takeover' and 'may significantly impact additional products' indicate a serious impact ceiling (likely guest-to-host or cross-component escape), which is why the score stays high despite the access constraints. Net: this is a genuinely high-impact flaw but a conditional, not opportunistic, one - it is a patch-in-normal-cycle priority for VirtualBox operators rather than an emergency, and in the absence of EPSS/KEV/POC there is no evidence of active or imminent mass exploitation. The 'Information Disclosure' tag understates the impact, which per the vector and description is full takeover, not mere disclosure.

An attacker who already holds high privileges on a system adjacent to (or on the same physical communication segment as) a VirtualBox 7.2.20 host leverages a flaw in the Core component to break the isolation boundary and take over the VirtualBox instance, with the scope change allowing impact to spread to other co-located products or the host itself. No public exploit code is identified at time of analysis, and the need for both adjacent-network positioning and high privileges makes this a targeted rather than drive-by scenario.