CVE-2026-87284: Low severity Oracle Oracle VM VirtualBox vulnerability
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 3.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
An attacker needs high privileges and a logon to the infrastructure where Oracle VM VirtualBox is running. This is a local attack vector; it is not described as remotely exploitable.
Which version is identified as affected?
Oracle VM VirtualBox 7.2.16 is identified as an affected supported version.
What could an attacker achieve after successful exploitation?
Successful exploitation can cause a partial denial of service of Oracle VM VirtualBox. The vulnerability may also significantly affect additional products because it has scope change.
Does exploitation require user interaction or difficult attack conditions?
No user interaction is required, and the attack complexity is rated low. However, the attacker must already hold high privileges on infrastructure where VirtualBox executes.