CVE-2026-87275 in VirtualBox
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.6 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the core component of Oracle VM VirtualBox, specifically affecting version 7.2.16 and potentially other supported releases depending on patch availability. This flaw represents a significant security risk because it allows for unauthorized access to sensitive data hosted within virtualized environments managed by this software. The nature of the defect is such that it can be exploited with relative ease once an attacker has established a foothold, highlighting a critical gap in the isolation mechanisms or internal state management of the hypervisor core.
Exploitation of this vulnerability requires specific and somewhat restrictive conditions to be met before any malicious action can occur. The attacker must possess high privileges on the host infrastructure where Oracle VM VirtualBox is executing. Furthermore, the attacker needs valid logon credentials to access that infrastructure. This implies that while the initial entry point might not require user interaction or complex social engineering, it does demand a pre-existing level of trust and administrative control over the physical or virtual machine hosting the hypervisor service. The requirement for high-privileged accounts suggests that this is primarily an insider threat vector or a consequence of lateral movement by an attacker who has already compromised host-level security controls.
The operational impact of successfully exploiting this flaw extends beyond the immediate compromise of Oracle VM VirtualBox itself, leading to what is described as a scope change in attack outcomes. The primary consequences involve unauthorized read access to a subset of data accessible within the virtualized environment and the ability to cause a partial denial of service against the VirtualBox application. This means that sensitive information stored on guest operating systems or managed by the hypervisor could be exfiltrated, leading to potential data breaches. Simultaneously, the availability impact manifests as a degradation in service performance or functionality for users relying on Oracle VM VirtualBox, disrupting business continuity and operational workflows dependent on these virtual machines.
From a classification perspective, this vulnerability aligns with CWE-200, which covers exposure of sensitive information to an unauthorized actor, due to the read access component. Additionally, the denial of service aspect relates to CWE-400, indicating uncontrolled resource consumption or availability impact. In terms of adversary tactics and techniques, as defined by MITRE ATT&CK, this scenario maps closely to T1537, which involves transferring data from cloud storage via a non-standard protocol if the accessed data is stored remotely, or more broadly to initial access and privilege escalation paths that leverage compromised host credentials. The partial denial of service could also be categorized under T1499, endpoint hardware/software disruption techniques, depending on how the resource exhaustion is achieved at the system level.
The CVSS 3.1 base score of 4.6 reflects a medium severity rating, driven by local attack vector requirements and high privilege prerequisites but mitigated somewhat by the lack of integrity impact in the standard scoring model despite the potential for broader scope changes. The vector string (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:L) confirms that while confidentiality is compromised at a low level and availability is affected, direct integrity manipulation is not scored as part of this specific metric set, though the practical implications may still affect system trustworthiness indirectly through data tampering or corruption resulting from instability.
To mitigate these risks, organizations should prioritize applying the latest security patches provided by Oracle for Oracle VM VirtualBox immediately upon release. It is crucial to enforce strict access controls on host infrastructure, ensuring that only essential personnel have high-privileged logon capabilities and that multi-factor authentication is implemented where possible to reduce the risk of credential compromise. Network segmentation strategies should be employed to limit lateral movement between hosts running virtualization software and other critical systems. Regular auditing of user privileges and monitoring for anomalous resource usage patterns can help detect potential exploitation attempts early, minimizing the window of exposure and reducing the overall attack surface associated with virtualized environments.