CVE-2026-87272 in VirtualBox
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the core component of Oracle VM VirtualBox version 7.2.16, representing a significant security risk for environments relying on this virtualization platform. As a critical element in cloud computing and software development workflows, VirtualBox manages guest operating systems with elevated privileges relative to standard user applications. The flaw allows an attacker who has already achieved low-privileged access to the host infrastructure where VirtualBox is executing to compromise the hypervisor itself. This scenario typically involves an adversary gaining initial foothold on a machine running VirtualBox through phishing, unpatched services, or weak authentication mechanisms, thereby satisfying the prerequisite of local logon capability before exploiting this specific core vulnerability.
From a technical perspective, the flaw enables privilege escalation from a low-privileged user context to full control over the Oracle VM VirtualBox process and potentially the underlying host system. The CVSS 3.1 base score of 7.8 indicates high severity, driven by impacts across confidentiality, integrity, and availability. The vector string AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms that while the attack requires local access and low complexity, it does not require user interaction and results in complete compromise of the affected component. This suggests a memory corruption issue or logic error within the core virtualization engine that allows arbitrary code execution or unauthorized memory access when processing specific inputs from guest machines or host-side management interfaces.
The operational impact of this vulnerability is severe due to its potential for lateral movement and persistent control. An attacker who successfully exploits this flaw can take over Oracle VM VirtualBox, effectively gaining a high-level foothold on the virtualization layer. This compromises not only the integrity of the hypervisor but also exposes all guest operating systems managed by that instance to further exploitation. Attackers may use this access to escape the sandboxed environment of the guest OS, accessing sensitive data stored on the host file system, intercepting network traffic between guests and the external world, or installing rootkits for long-term persistence. The availability impact implies that attackers could also crash the virtualization service, leading to denial-of-service conditions for all running virtual machines.
This vulnerability aligns with Common Weakness Enumeration categories such as CWE-787: Out-of-bounds Write or CWE-120: Buffer Overflow if memory corruption is involved, or CWE-269: Improper Privilege Management if the issue stems from insufficient access control checks within the core logic. In terms of MITRE ATT&CK framework mapping, this exploit facilitates Initial Access via Local Exploitation followed by Defense Evasion and Persistence through privilege escalation to SYSTEM or root level on the host. It also enables Credential Access as attackers can dump memory for passwords and keys stored in the hypervisor process space.
Mitigation strategies must prioritize immediate patching of Oracle VM VirtualBox to version 7.2.16 or later, where this core flaw has been addressed by Oracle. Organizations should enforce strict network segmentation to limit local access opportunities on systems running virtualization software. Additionally, implementing least-privilege principles for user accounts interacting with the host OS reduces the attack surface for low-privileged attackers attempting to reach the VirtualBox process. Security monitoring solutions should be configured to detect anomalous behavior associated with hypervisor processes, such as unexpected memory allocations or unauthorized access attempts to sensitive system resources. Regular vulnerability scanning and adherence to vendor security advisories are essential components of a robust defense-in-depth strategy against virtualization-specific threats.