CVE-2026-87278: Medium severity Oracle Oracle VM VirtualBox vulnerability
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Systems running Oracle VM VirtualBox 7.2.16 are affected. Exploitation is local: the attacker needs logon access to the infrastructure where VirtualBox runs.
Does exploitation require user interaction?
Yes. A person other than the attacker must interact for an attack to succeed, despite the attacker requiring no privileges.
What could a successful attack do?
An attacker could cause VirtualBox to hang or crash repeatedly, resulting in a complete denial of service. The attacker could also gain unauthorized ability to update, insert, or delete some data accessible to VirtualBox.