Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-18T21:18:13.967Z",
  "pubdate": "2026-08-18T21:18:13.967Z",
  "executiveSummary": "An easily exploitable vulnerability has been identified in the Core component of the Oracle VM VirtualBox product within Oracle Virtualization, specifically affecting version 7.2.14. This vulnerability enables an unauthenticated attacker with local logon access to the underlying infrastructure hosting the virtualization software to fully compromise Oracle VM VirtualBox. Successful exploitation carries a CVSS 3.1 Base Score of 8.6, demonstrating high severity with maximum impacts on confidentiality, integrity, and availability. Notably, the vulnerability exhibits a scope change (S:C), meaning successful attacks may significantly impact additional products and system components beyond the immediate VirtualBox boundary. The attack vector is localized (AV:L), requiring low attack complexity (AC:L) with no prior privileges (PR:N) required for the initiating actor. However, successful exploitation strictly mandates human interaction (UI:R) from a distinct individual other than the attacker. Organizations utilizing the affected version face severe risk of complete application takeover, necessitating immediate administrative attention and adherence to vendor-provided remediation guidance to prevent unauthorized infrastructure escalation and cross-product compromise.",
  "technicalDetails": "The security flaw resides within the Core component of Oracle VM VirtualBox version 7.2.14, handling foundational virtualization operations and resource management. The attack vector is classified as Local (AV:L), requiring the adversary to possess valid logon capabilities to the host infrastructure where Oracle VM VirtualBox executes. Despite requiring local infrastructure access, the vulnerability features low attack complexity (AC:L) and does not require pre-existing privileges (PR:N), lowering the barrier for internal threat actors or compromised low-privileged accounts operating on the host system. A critical prerequisite for successful exploitation is the inclusion of human interaction (UI:R) from a person other than the attacker, indicating that the attack sequence relies on a user-driven action—such as executing a specific workflow, interacting with a graphical interface element, or processing a crafted local artifact—to trigger the underlying flaw. The vulnerability involves a scope change (S:C), signifying that the privileges and vulnerabilities within the VirtualBox boundary can propagate outwards to impact resources, hypervisors, or additional software products residing within the broader infrastructure context. The step-by-step attack flow begins with the unauthenticated attacker gaining logon access to the host environment. The attacker then orchestrates conditions requiring user interaction from a victim on the system. Upon execution and successful user engagement, the vulnerability triggers a failure within the Core component handling memory, execution flow, or privilege boundaries. This breakdown allows the attacker to bypass isolation mechanisms, resulting in the complete takeover of the Oracle VM VirtualBox instance. The post-exploitation impact includes high confidentiality, integrity, and availability (C:H/I:H/A:H) breaches, potentially granting the attacker complete administrative control over guest virtual machines, host interactions, and adjacent product scopes tied to the virtualization ecosystem."
}