CVE-2026-21955: High severity Oracle Oracle VM VirtualBox vulnerability

Published Jan 20, 2026

Updated

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Affected Software

3 affected components

Oracle Oracle VM VirtualBox

Oracle VM VirtualBox=7.1.14

Oracle VM VirtualBox=7.2.4

Event History

Jan 20, 2026

CVE Published

via MITRE·09:56 PM

Data Sourced

via MITRE·09:56 PM

DescriptionSeverity

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Feb 19, 58052

Event

via FIRST·07:01 PM

Frequently Asked Questions

What is the severity of CVE-2026-21955?

CVE-2026-21955 is rated as a high severity vulnerability due to its potential for exploitation by privileged attackers.

How do I fix CVE-2026-21955?

To fix CVE-2026-21955, upgrade Oracle VM VirtualBox to the latest patched version provided by Oracle.

Who is impacted by CVE-2026-21955?

CVE-2026-21955 affects users of Oracle VM VirtualBox versions 7.1.14 and 7.2.4.

What type of vulnerability is CVE-2026-21955?

CVE-2026-21955 is an easily exploitable vulnerability that allows high privileged attackers to compromise systems running Oracle VM VirtualBox.

What products are affected by CVE-2026-21955?

The affected product by CVE-2026-21955 is the Oracle VM VirtualBox virtualization software.