CVE-2026-71141 in VM VirtualBox
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the core component of Oracle VM VirtualBox version 7.2.14, representing a significant security flaw in one of the most widely deployed virtualization platforms globally. This issue is classified as an easily exploitable vulnerability that permits unauthenticated attackers to compromise the host infrastructure upon which Oracle VM VirtualBox operates. The attack vector requires local access, meaning the attacker must have logon capabilities on the system running the hypervisor. While the initial point of entry is limited to authenticated users with shell or desktop access, the severity lies in the potential for privilege escalation and lateral movement beyond the immediate virtualized environment. This aligns with CWE-269, which addresses Improper Privilege Management, as the flaw allows a lower-privileged user to gain unauthorized control over critical system resources.
The operational impact of this vulnerability is severe due to its scope change characteristic. Although the technical flaw exists within Oracle VM VirtualBox itself, successful exploitation can significantly impact additional products and services running on or connected to the host infrastructure. This expansion of attack surface means that compromising the virtualization layer does not merely affect isolated guest operating systems but poses a risk to the underlying physical hardware management interfaces, network configurations, and other co-located applications. The CVSS 3.1 base score of 7.7 reflects high impacts on integrity, with moderate impacts on confidentiality and availability. Specifically, attackers can achieve unauthorized creation, deletion, or modification of critical data stored within the virtualized environment as well as all accessible data managed by VirtualBox. This level of integrity violation corresponds to CWE-362, indicating a concurrent execution race condition or improper synchronization that allows malicious actors to alter system state unexpectedly.
Furthermore, the vulnerability grants unauthorized read access to a subset of Oracle VM VirtualBox accessible data and enables an attacker to cause a partial denial of service against the virtualization platform itself. The requirement for human interaction from a person other than the attacker suggests that social engineering or specific user actions may be necessary to trigger the exploit condition fully, which is reflected in the CVSS vector's UI:R (User Interaction Required) attribute. This characteristic places the vulnerability within ATT&CK technique T1059, Command and Scripting Interpreter, if the exploitation involves executing arbitrary commands on the host, or potentially T1496, Resource Hijacking, if it leads to resource exhaustion causing denial of service. The partial denial of service impact indicates that while full system collapse may not be guaranteed, performance degradation or unavailability of specific virtual machine operations can disrupt business continuity and operational workflows dependent on stable hypervisor performance.
Mitigation strategies must focus on strict access control policies for the host operating systems running Oracle VM VirtualBox. Administrators should ensure that only trusted, authorized personnel have local logon privileges to these machines, effectively reducing the attack surface defined by AV:L (Local Attack Vector). Regular patching is critical; organizations must upgrade from version 7.2.14 to a patched release where this core component flaw has been resolved. Additionally, implementing network segmentation can limit the blast radius if an attacker does manage to exploit the vulnerability on one host, preventing lateral movement to other critical infrastructure components. Monitoring for unusual process creation or resource consumption patterns within VirtualBox instances can also aid in early detection of exploitation attempts aligned with ATT&CK technique T1053, Scheduled Task/Job, should the malware attempt persistence through scheduled operations triggered by the initial compromise.