CVE-2026-21990: High severity Oracle Oracle VM VirtualBox vulnerability
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21990?
CVE-2026-21990 has a high severity due to its potential for exploitation by a privileged attacker.
How does CVE-2026-21990 affect Oracle VM VirtualBox?
CVE-2026-21990 affects Oracle VM VirtualBox versions 7.1.14 and 7.2.4 by allowing high privileged attackers to compromise the system.
How do I fix CVE-2026-21990?
To fix CVE-2026-21990, update Oracle VM VirtualBox to the latest version released by Oracle.
Who is at risk with CVE-2026-21990?
Administrators and users who have high privileges in environments using affected versions of Oracle VM VirtualBox are at risk with CVE-2026-21990.
What could an attacker achieve by exploiting CVE-2026-21990?
An attacker exploiting CVE-2026-21990 could gain unauthorized access and compromise the integrity of the virtual machine infrastructure.