CVE-2026-47054 in VirtualBox
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Windows host only. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle VM VirtualBox's core component of the Oracle Virtualization suite, specifically affecting version 7.2.12 on Windows host systems. The flaw represents a significant security weakness that can be exploited by attackers who already possess legitimate login credentials to the host infrastructure where VirtualBox operates. The vulnerability's exploitability is characterized as easily accessible, meaning that an attacker with minimal privileges can potentially leverage this weakness to gain complete control over the VirtualBox instance itself.
The technical nature of this vulnerability stems from insufficient access controls or privilege management within the VirtualBox core functionality, allowing a low-privileged user who has already established a foothold on the host system to escalate their privileges and compromise the virtualization environment. The CVSS 3.1 scoring of 7.8 indicates high severity across all impact vectors including confidentiality, integrity, and availability, demonstrating that successful exploitation could lead to complete system compromise where an attacker gains full control over VirtualBox operations.
The operational impact of this vulnerability extends beyond simple privilege escalation as it provides attackers with the ability to manipulate virtual machine configurations, access guest operating systems, and potentially use the compromised VirtualBox instance as a pivot point for further attacks within the network infrastructure. This represents a critical threat vector because VirtualBox often runs with elevated privileges on host systems, making successful exploitation particularly damaging. The vulnerability's Windows-only restriction means that while organizations using other operating systems are not directly affected, those running Windows-based VirtualBox deployments face immediate and serious security concerns.
Organizations should implement immediate mitigations including updating to the latest supported version of Oracle VM VirtualBox where patches are available, implementing strict access controls and monitoring for unusual activities on systems hosting VirtualBox instances, and considering network segmentation to limit potential lateral movement if exploitation occurs. The vulnerability aligns with CWE-284 (Improper Access Control) and may map to ATT&CK techniques involving privilege escalation and persistence within virtualized environments. Security teams should also consider implementing additional host-based security controls such as application whitelisting, process monitoring, and regular security assessments of virtualization infrastructure to prevent exploitation of this class of vulnerability.