CVE-2026-87273 in VM VirtualBox
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the core component of Oracle VM VirtualBox version 7.2.16, representing a significant security flaw in one of the most widely deployed virtualization platforms globally. This issue is classified as an easily exploitable vulnerability that permits unauthenticated attackers to compromise the host system running the hypervisor. The attack vector requires local access with logon privileges on the infrastructure where Oracle VM VirtualBox executes, indicating that while remote exploitation is not directly possible without prior network penetration or physical access, the barrier for entry remains relatively low due to the lack of authentication requirements once inside the environment. This characteristic aligns closely with CWE-269, which addresses Improper Privilege Management, as the vulnerability allows an entity with basic user-level credentials to escalate privileges and gain control over critical system resources beyond their intended scope.
The operational impact of this vulnerability is severe, characterized by a CVSS 3.1 Base Score of 8.6, reflecting high impacts on confidentiality, integrity, and availability. Successful exploitation leads directly to the takeover of Oracle VM VirtualBox, effectively granting the attacker full control over the virtualization layer. This compromise extends beyond the immediate application due to scope change dynamics inherent in hypervisor vulnerabilities; because the hypervisor manages all guest operating systems and their interactions with physical hardware, compromising it can lead to isolation failures between virtual machines. An attacker could potentially escape from a sandboxed guest environment to access other guests or the host system itself, leading to data exfiltration, lateral movement within the network, or complete denial of service by disrupting critical workloads hosted on the compromised infrastructure.
From an offensive security perspective, this vulnerability maps to MITRE ATT&CK techniques related to privilege escalation and container hypervisor escape. Attackers leveraging this flaw would likely employ methods consistent with T1068 Exploitation for Privilege Escalation or potentially T1499 Endpoint Denial of Service if the goal is disruption rather than persistence. The requirement for human interaction suggests that social engineering tactics may be necessary to facilitate initial access, such as tricking a user into running a malicious script or application within the virtualized environment that triggers the underlying core flaw. This dependency on user action does not diminish the severity but highlights the importance of endpoint protection and behavioral analysis in detecting anomalous activities originating from trusted applications like VirtualBox.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is to apply the latest security patches provided by Oracle, ensuring that all instances of Oracle VM VirtualBox are updated beyond version 7.2.16 where this core flaw has been addressed. Organizations should also enforce strict least-privilege principles for user accounts interacting with virtualization software, limiting administrative rights wherever possible. Additionally, implementing network segmentation to isolate critical workloads from general-purpose desktop environments can reduce the blast radius of a potential compromise. Security teams should monitor for unusual process creation or memory access patterns associated with VirtualBox processes using endpoint detection and response tools configured to flag deviations from baseline behavior indicative of exploitation attempts. Regular audits of virtual machine configurations and strict control over USB device passthrough settings further mitigate risks associated with physical layer attacks that could exploit similar weaknesses in the future.