Vm Virtualbox

Oracle VM VirtualBox 7.2.14 Core component allows a low-privileged local attacker to read critical data, with the impact scope extending beyond the VirtualBox instance itself - potentially exposing host system or cross-VM sensitive data. Exploitation is constrained by high attack complexity and mandatory local access, making mass exploitation impractical; targeted insider or post-compromise scenarios represent the realistic threat model. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the official Oracle CPU advisory for August 2026 is the authoritative source.

Oracle VM VirtualBox 7.2.14 Core component exposes a scope-changing integrity vulnerability that allows a local unauthenticated attacker - with logon access to the infrastructure hosting the hypervisor - to critically compromise VirtualBox data when a legitimate third party interacts with the product. The attack vector is local and requires human interaction, but the CVSS scope change (S:C) indicates that a successful exploit can break VM containment and significantly impact the host system or co-resident components beyond VirtualBox itself. No public exploit is identified at time of analysis, and the vulnerability is addressed via Oracle's August 2026 Critical Security Patch Update.

Oracle VM VirtualBox 7.2.14 (Core component) exposes a low-severity local vulnerability that permits a high-privileged attacker with logon access to the host infrastructure to perform unauthorized read and limited write operations against a subset of VirtualBox-accessible data. Confidentiality and integrity are partially affected; availability is not impacted. No public exploit has been identified at time of analysis, and the combination of local-only attack vector and required high-privilege access significantly narrows the realistic attacker population.

Denial-of-service in Oracle VM VirtualBox 7.2.14 Core component allows a high-privileged local attacker to repeatably crash or hang the hypervisor, taking down all hosted virtual machines. Exploitation requires high-privilege local logon access to the host, and Oracle's August 2026 CPU includes a fix. No public exploit code and no CISA KEV listing have been identified, keeping real-world risk limited despite the "easily exploitable" descriptor used by Oracle.

Local privilege escalation and denial-of-service in Oracle VM VirtualBox 7.2.14 allows a high-privileged attacker with local infrastructure access to crash the hypervisor, partially read or modify VM-accessible data, and - critically - extend impact beyond the vulnerable instance to additional products via a confirmed scope change. The CVSS 3.1 vector (AV:L/PR:H/S:C/A:H) indicates this is not a remote threat but a post-compromise or insider-level concern targeting the virtualization layer. No public exploit code or active exploitation has been identified at time of analysis, and Oracle disclosed this through its Critical Patch Update for August 2026.

Oracle VM VirtualBox 7.2.14 contains a local privilege-escalation-to-DoS flaw in the Core component that allows a highly privileged host user to repeatedly crash or hang the hypervisor, with scope change meaning hosted guest VMs are also disrupted. The attack requires local logon and high privileges on the host infrastructure, substantially limiting the attacker pool to insiders or already-compromised privileged accounts. No public exploit code or active exploitation has been identified at time of analysis; EPSS data was not provided.

Local privilege escalation with scope change in Oracle VM VirtualBox 7.2.14 allows a high-privileged local attacker to crash the hypervisor repeatedly, modify limited guest data, and read a subset of accessible data - with impacts that extend beyond the VirtualBox process to additional co-hosted products. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog. The scope change (S:C in CVSS) is the critical differentiator, indicating that a compromised VirtualBox instance can affect the host OS or sibling VMs, raising the actual blast radius above what the per-component impact ratings suggest.

Oracle VM VirtualBox 7.2.14 Core component allows a high-privileged local attacker to trigger a complete denial-of-service condition - causing a hang or frequently repeatable crash of the hypervisor - with a confirmed scope change that can significantly impact additional products beyond VirtualBox itself, likely the host operating system or co-resident guest VMs. The vulnerability is exploitable by an attacker with administrator-level access already present on the host infrastructure, making it most relevant in multi-tenant or shared virtualization environments where privileged-but-not-hypervisor-owner threat actors are a realistic model. No public exploit code or CISA KEV listing has been identified at time of analysis.

Oracle VM VirtualBox 7.2.14 contains a locally exploitable flaw in its Core component that grants high-privileged local attackers partial read, write, and denial-of-service capabilities, with a confirmed scope change meaning the impact can extend to products or components beyond VirtualBox itself. The vulnerability is described as 'easily exploitable' by Oracle, though the high privilege and local access requirements substantially constrain the realistic attacker pool. No public exploit code or CISA KEV listing has been identified at time of analysis.

Oracle VM VirtualBox 7.2.14 Core component exposes a local confidentiality vulnerability enabling a high-privileged attacker with local infrastructure access to read critical data across VM isolation boundaries, with confirmed scope change indicating potential host or cross-VM data exposure. The CVSS vector (AV:L/AC:H/PR:H/S:C/C:H/I:N/A:N) reflects a narrow but impactful attack path constrained by high complexity and privilege prerequisites. No public exploit has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, placing it in a low-urgency tier for most environments despite the high confidentiality impact when scope change is considered.

Full takeover of Oracle VM VirtualBox 7.2.14 is achievable by a local, unprivileged attacker who can induce a victim user to interact with a malicious guest or crafted input, with the scope change indicator in the CVSS vector (S:C) strongly suggesting a guest-to-host boundary breach impacting the underlying infrastructure. The complete C:H/I:H/A:H impact triad confirms that successful exploitation results in total loss of confidentiality, integrity, and availability of both the VirtualBox process and potentially the host system. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Remote unauthenticated exploitation of Oracle VM VirtualBox 7.2.14 via its RDP component allows attackers to bypass authentication and gain full read access to all VirtualBox-accessible session data as well as limited write capability, without requiring any credentials or user interaction. The vulnerability resides in the Core component's Virtual Remote Desktop Extension (VRDE), exposed over the network via RDP. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-authentication network vector and low attack complexity make this a high-priority patching candidate for any deployment with VRDE enabled.

Full takeover of Oracle VM VirtualBox 7.2.14 is achievable by a locally-authenticated, high-privileged attacker, with confirmed scope change indicating the compromise extends beyond the hypervisor to additional products - consistent with a VM escape or host privilege escalation pattern. The CVSS vector (AV:L/PR:H/S:C/C:H/I:H/A:H) signals that despite the elevated privilege bar, successful exploitation yields complete confidentiality, integrity, and availability impact across system boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is disclosed via Oracle's August 2026 Critical Patch Update advisory.

Oracle VM VirtualBox 7.2.14 Core component allows a high-privileged local attacker to cause a complete denial of service - hang or repeatable crash - with a scope change that can impact additional products beyond VirtualBox itself, such as guest virtual machines sharing the same host. The vulnerability is locally-triggered and requires existing privileged access to the infrastructure, limiting opportunistic exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, and EPSS data was not available in the provided intelligence.

Oracle VM VirtualBox 7.2.14 Core component exposes a locally exploitable denial-of-service condition that can be triggered by a high-privileged attacker with logon access to the host infrastructure. Exploitation results in a complete, repeatably triggerable crash or hang of the VirtualBox process, with scope change indicated - meaning the disruption can cascade to guest virtual machines and other co-hosted workloads. No public exploit code exists and no active exploitation has been identified at time of analysis.

Full takeover of Oracle VM VirtualBox 7.2.14 is achievable by a low-privileged local attacker through a high-complexity exploit targeting the Core component, with successful attacks crossing the VM boundary to significantly impact the host and potentially co-hosted workloads. The scope change indicated in the CVSS vector (S:C) is consistent with a VM escape class of vulnerability, making this critical in shared or multi-tenant infrastructure despite the local access prerequisite. No public exploit code or active exploitation has been identified at the time of analysis; exploitation probability remains unquantified due to the absence of EPSS data.

Oracle VM VirtualBox 7.2.14 (Core component) is affected by a locally exploitable vulnerability that allows a low-privileged, unauthenticated local user to cause a complete denial of service - a hang or repeatable crash - of the hypervisor, as well as unauthorized modification of a subset of its accessible data. Exploitation requires physical or logical local access to the host infrastructure and human interaction from a separate user (e.g., a legitimate VirtualBox user performing a VM operation). No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.

Full hypervisor takeover in Oracle VM VirtualBox 7.2.14 is achievable by a locally authenticated, highly privileged attacker exploiting a flaw in the Core component, with successful attacks producing a scope change that may compromise systems beyond the primary VirtualBox instance. The CVSS vector confirms local-only access with high privilege and complexity prerequisites, but the S:C scope change elevates real-world impact substantially - a compromised hypervisor exposes all hosted guest VMs and their data. Disclosed in Oracle's August 2026 Critical Security Update, no public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.

Oracle VM VirtualBox 7.2.14 Core component contains a vulnerability that allows a high-privileged local attacker to breach VM isolation boundaries and access all confidential data accessible to VirtualBox, including data from guest virtual machines. The CVSS scope-change metric (S:C) confirms that successful exploitation extends impact beyond the VirtualBox process itself, enabling unauthorized read access to critical data across VM boundaries. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the EUVD 'Authentication Bypass' tag suggests the vulnerability may undermine guest-level authentication or isolation enforcement mechanisms.

Confidentiality compromise in Oracle VM VirtualBox 7.2.14 Core component allows a locally authenticated, high-privileged attacker to access all data reachable by the VirtualBox process and breach isolation boundaries to impact additional products via scope change. The 'Authentication Bypass' tag supplied by the reporter suggests an internal access-control bypass within VirtualBox's security model that extends an attacker's data reach beyond their normally authorized scope. No public exploit code or active exploitation has been confirmed at time of analysis.

Unauthenticated remote denial-of-service in Oracle VM VirtualBox 7.2.14 allows a network attacker to hang or crash the hypervisor via the RDP interface without any credentials or user interaction. The vulnerability resides in the Core component and is rated easily exploitable by Oracle, yielding complete availability loss of the affected VirtualBox instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to trigger against exposed deployments.

Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to takeover of Oracle VM VirtualBox (CVSS 8.2).

Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to unauthorized creation, deletion or modification access to critical data or all O (CVSS 8.1).

Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to takeover of Oracle VM VirtualBox (CVSS 8.2).

Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to takeover of Oracle VM VirtualBox (CVSS 8.2).

Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable crash (complete DO (CVSS 7.1).

Vm Virtualbox versions up to 7.1.14 contains a vulnerability that allows attackers to unauthorized access to critical data or complete access to all Oracle VM Virtual (CVSS 6.0).

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 7.5 HIGH]

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 7.5 HIGH]

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 7.5 HIGH]

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 4.6 MEDIUM]

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 6.0 MEDIUM]

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 7.5 HIGH]

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 8.2 HIGH]

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. [CVSS 8.2 HIGH]

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 6.7). This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 8.1), this vulnerability is low attack complexity. Public exploit code available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 7.5). No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated low severity (CVSS 2.3), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 5.3). No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated low severity (CVSS 2.5). No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 7.9), this vulnerability is low attack complexity.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 8.2), this vulnerability is low attack complexity.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated low severity (CVSS 3.6). No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated low severity (CVSS 3.2), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated low severity (CVSS 3.8), this vulnerability is low attack complexity. No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 7.8). No vendor patch available.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated low severity (CVSS 3.8), this vulnerability is low attack complexity.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated low severity (CVSS 3.8), this vulnerability is low attack complexity.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 8.8), this vulnerability is low attack complexity.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 7.5). This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.