CVE-2026-47054: High severity Oracle Oracle VM VirtualBox vulnerability
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Windows host only. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle VM VirtualBox (Core)to a version that resolves this vulnerability.Fixed in 7.2.12 - Compensating control
Limit access to Oracle VM VirtualBox on Windows hosts to trusted users; the vulnerability is stated to apply to Windows host only and requires a low-privileged attacker with logon.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47054?
The severity of CVE-2026-47054 is classified as high with a CVSS score of 7.8.
How do I fix CVE-2026-47054?
To fix CVE-2026-47054, update your Oracle VM VirtualBox to version 7.2.13 or later.
What are the risks associated with CVE-2026-47054?
CVE-2026-47054 allows low privileged attackers to compromise Oracle VM VirtualBox and gain access to sensitive information.
Which versions of Oracle VM VirtualBox are affected by CVE-2026-47054?
The affected version of Oracle VM VirtualBox with CVE-2026-47054 is 7.2.12.
Who is at risk of CVE-2026-47054?
Any organization using Oracle VM VirtualBox 7.2.12 may be at risk if low privileged attackers gain access to the infrastructure.