Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via RDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-18T21:18:13.853Z",
  "pubdate": "2026-08-18T21:18:13.853Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Core component of Oracle VM VirtualBox version 7.2.14, allowing remote network-based compromise via the RDP protocol.\nThe vulnerability allows an unauthenticated attacker with network access to execute attacks without requiring user interaction.\nSuccessful exploitation results in severe security impacts, specifically granting unauthorized access to critical data or complete access to all data accessible by Oracle VM VirtualBox.\nAdditionally, successful attacks permit unauthorized update, insert, or delete access to a subset of accessible data, severely undermining data integrity.\nThe vulnerability carries a CVSS 3.1 Base Score of 8.2 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting high confidentiality impact and low-to-moderate integrity impact.\nDue to the lack of required authentication and privileges, organizations running the affected version face significant risk of data exposure and unauthorized data manipulation if exposed to untrusted networks.",
  "technicalDetails": "The vulnerability resides in the Core component of Oracle VM VirtualBox version 7.2.14, specifically handling incoming network connections utilizing the Remote Desktop Protocol (RDP).\nThe flaw allows an unauthenticated remote attacker to leverage network exposure to interact directly with the vulnerable virtualization service without needing prior credentials or session tokens.\nAttack execution requires low complexity (AC:L) and zero user interaction (UI:N), meaning an adversary can initiate and execute the attack autonomously once network connectivity to the target VirtualBox RDP interface is established.\nThe attack flow begins when an attacker sends specially crafted RDP payloads to the targeted Oracle VM VirtualBox instance over the network.\nDue to inadequate input validation, memory safety checks, or improper state handling within the Core RDP processing logic, the crafted packets trigger unintended logic execution or memory exposure.\nThis behavior allows the adversary to bypass security boundaries, granting unauthorized read access to critical or complete sets of data accessible within the context of the VirtualBox environment.\nFurthermore, the vulnerability permits the attacker to perform unauthorized data modification operations, specifically executing insert, update, or delete commands against accessible data structures.\nThe exploitation scope remains unchanged (S:U), but the combined impact yields high confidentiality degradation and low integrity compromise.\nPost-exploitation impacts include the potential exfiltrations of sensitive host or guest environment data and the unauthorized tampering of virtualized application data repositories."
}