EUVD-2026-24454
GHSA-9qx2-6rq5-w5jj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed VRDP/RDP port
-
DeliverySend crafted RDP session request
-
ExploitTrigger improper access control fault in Core
-
ExecutionVirtualBox process hangs or crashes
-
ImpactComplete DoS of VM/host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target VM has the VirtualBox Remote Desktop Protocol (VRDP) server enabled and network-reachable by the attacker - this is the exact feature named as the attack path ('network access via RDP') and it is NOT enabled in a default VirtualBox configuration, which is the primary limiting factor. Given the CVSS vector PR:N/UI:N, no authentication and no user interaction are needed once VRDP is exposed. What limits real-world risk: the non-default VRDP feature must be turned on, the RDP/VRDP port must be reachable from the attacker (often firewalled or bound to internal networks), and the confirmed affected version is specifically 7.2.6; where VRDP is off, this vulnerability is not remotely reachable. |
| Impact | Signals are mixed and lean toward lower operational urgency than the CVSS 7.5 alone would suggest. The CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H) indicates an easy, unauthenticated, network-reachable attack, but impact is confined to availability (C:N/I:N) - a pure DoS with no data compromise or code execution. SSVC corroborates this: Exploitation=none (no observed activity), Automatable=yes (network-facing and scriptable), Technical Impact=partial. EPSS is very low (0.04%, 12th percentile) and the CVE is not in CISA KEV, with no public POC. A crucial limiting factor not reflected in the CVSS score is that VirtualBox's VRDP/RDP server is not enabled by default and is typically bound to trusted networks, so 'network access via RDP' presupposes an operator turned the remote display feature on. Net: a legitimate patch-worthy availability bug, but for most deployments this is a moderate, not emergency, priority. |
| Exploit ScenarioDerived | An attacker who can reach an exposed VirtualBox VRDP/RDP port sends a crafted or malformed RDP session request to the remote display service without any credentials, causing the VirtualBox process to hang or crash and taking the VM (and its workloads) offline. Because SSVC rates the flaw automatable, the attacker could script this against many reachable hosts to cause repeatable outages; however, no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over the VirtualBox Remote Desktop Protocol (VRDP/RDP) service trigger a hang or repeatable crash, producing a complete availability loss of the virtualization host process. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 12th percentile), so while the flaw is network-reachable and unauthenticated, real-world exploitation pressure currently appears minimal. Note that the supplied 'Authentication Bypass' tag conflicts with the availability-only CVSS vector - the confirmed impact is DoS, not auth bypass.
RemediationAI
Apply the fixes from the Oracle Critical Patch Update of April 2026 (https://www.oracle.com/security-alerts/cpuapr2026.html) - Patch available per vendor advisory; an exact fixed VirtualBox build number was not provided in the source data, so confirm the target version in the CPU matrix before deploying. As an immediate compensating control until patched, disable the VirtualBox Remote Desktop (VRDP) server for VMs that do not require remote console access (VBoxManage modifyvm <vm> --vrde off), which fully removes the attack surface at the cost of losing remote display for those VMs. If VRDP must remain enabled, restrict access by binding it to loopback or a management-only interface and firewalling the VRDP port (default 3389) so only trusted administrative hosts can reach it, and enable VRDP authentication - the trade-off is added connection friction and tighter network segmentation requirements. Because the impact is DoS only, no data-exposure containment is needed, but ensure affected hypervisor hosts are monitored for repeated crash/restart patterns.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is Oracle VM VirtualBox, a widely used type-2 hypervisor, specifically its Core component and its built-in remote display service (VRDP), which speaks the RDP protocol to allow remote console access to guest VMs. The CPE cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox:*:*:*:*:*:*:*:* identifies the Oracle VirtualBox application as the affected product. The assigned root-cause class is CWE-284 (Improper Access Control); combined with the described crash/hang, this most plausibly reflects the RDP-facing parser or session handling accepting malformed input that it does not properly validate, terminating the VM/host process rather than an actual privilege or authentication bypass despite the misleading vendor tag.
Know when Oracle Vm Virtualbox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network reachability over VRDP yields AV:N/AC:L/PR:N/UI:N; impact is a pure availability crash (A:H) with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via RDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Executive ViewAI
Oracle VM VirtualBox 7.2.6 contains a network-accessible denial-of-service vulnerability in its remote desktop service that allows unauthenticated attackers to completely crash the virtualization host, rendering all hosted virtual machines inaccessible. Organizations using VirtualBox for production workloads face critical infrastructure availability risk until compensating controls are deployed.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable VRDP protocol entirely if not operationally required; (2) Restrict VRDP access to internal-only networks via firewall rules and network ACLs; (3) Implement connection-rate limiting and intrusion detection on VRDP ports to detect attack patterns; (4) Establish rapid reboot and service restart procedures to minimize recovery time from crash incidents; (5) Monitor VirtualBox process health and configure automated alerts for host process termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Vm Virtualbox
View allLocal privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged a
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged atta
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privile
Privileged local compromise of Oracle VM VirtualBox 7.2.8 allows an attacker already authenticated to the host with high
Privilege escalation and host takeover in Oracle VM VirtualBox 7.2.8 via the VMSVGA virtual graphics device allows a hig
Confidentiality and integrity compromise in Oracle VM VirtualBox 7.2.8 (Shared Folders component) allows a low-privilege
Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is alread
Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attack
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker w
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can
Guest-to-host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker to take
Exploit-DB