CVE-2026-21982: High severity Oracle VM VirtualBox vulnerability
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21982?
CVE-2026-21982 is categorized as a difficult to exploit vulnerability in Oracle VM VirtualBox, affecting versions 7.1.14 and 7.2.4.
How do I fix CVE-2026-21982?
To remediate CVE-2026-21982, update your Oracle VM VirtualBox to the latest version that is not affected by this vulnerability.
Who is affected by CVE-2026-21982?
Users of Oracle VM VirtualBox versions 7.1.14 and 7.2.4 may be affected by CVE-2026-21982 if they have an unauthenticated attacker gaining access to their hardware communication segment.
What components of Oracle VM VirtualBox does CVE-2026-21982 impact?
CVE-2026-21982 impacts the core component of the Oracle VM VirtualBox product.
When was CVE-2026-21982 disclosed?
CVE-2026-21982 was disclosed as part of Oracle's security alerts for January 2026.