CVE-2026-87277 in VirtualBox
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via RDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the core component of Oracle VM VirtualBox, specifically affecting version 7.2.16 and potentially other supported releases in that lineage. This flaw represents a critical security deficiency that undermines the stability and availability of the virtualization platform. The nature of this issue is characterized by its ease of exploitation, allowing an unauthenticated attacker to leverage network access via the Remote Desktop Protocol (RDP) interface to trigger severe disruptions within the host environment. Unlike vulnerabilities that compromise confidentiality or integrity by stealing data or altering system states, this specific flaw targets the availability aspect of the security triad, posing a direct threat to the operational continuity of systems relying on Oracle VM VirtualBox for their infrastructure needs.
From a technical perspective, the vulnerability allows an attacker who has network connectivity to the RDP service associated with the virtual machine to induce a hang or a frequently repeatable crash of the Oracle VM VirtualBox application itself. This mechanism effectively results in a complete denial of service condition where the host software becomes unresponsive or terminates unexpectedly. The attack vector is classified as remote and requires no prior authentication, which significantly lowers the barrier for entry for malicious actors. Furthermore, there are no user interaction requirements such as clicking on a link or opening an attachment, making this vulnerability particularly dangerous in automated scanning scenarios or when deployed in environments with exposed RDP ports. The simplicity of exploitation combined with the lack of prerequisites makes it a high-risk issue that can be triggered by any entity capable of reaching the vulnerable service over the network.
The operational impact of this vulnerability is substantial for organizations utilizing Oracle VM VirtualBox, particularly those exposing virtual machines to untrusted networks or public internet segments via RDP. A successful exploitation leads to a complete denial of service, meaning that not only does the targeted virtual machine become inaccessible due to the host application crashing, but it may also disrupt other workloads running on the same physical host if they share critical resources or are affected by the instability caused by the crash. This can result in significant downtime for business-critical applications hosted within these virtual environments. The CVSS 3.1 base score of 7.5 reflects this high severity, primarily driven by the availability impact and the low complexity required to execute the attack. For administrators managing cloud infrastructure or development labs where VirtualBox is used as a backend service, such instability can lead to data loss if unsaved workloads are abruptly terminated and disrupts service level agreements dependent on uptime guarantees.
In terms of industry standard classifications, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption leading to denial of service conditions. The attack vector corresponds to ATT&CK technique T1499, Endpoint Denial of Service, specifically under the sub-category of Resource Hijacking or exhaustion that leads to system instability. Additionally, because it involves a remote network-based trigger without authentication, it falls under MITRE ATT&CK tactic TA0002 Execution and TA0005 Defense Evasion in contexts where attackers might use such crashes to mask other activities or simply as an act of disruption. Understanding these mappings helps security teams prioritize remediation efforts based on established threat intelligence frameworks rather than relying solely on vendor advisories.
To mitigate the risks associated with this vulnerability, immediate action is required to update Oracle VM VirtualBox to a patched version that addresses the core component flaw. Until such updates are applied or deployed in production environments, organizations should implement strict network access controls to restrict RDP connectivity to trusted IP ranges only. Utilizing firewalls and intrusion prevention systems can help block unauthorized attempts to connect to the vulnerable service ports. Additionally, enabling multi-factor authentication for any remaining administrative interfaces adds a layer of defense-in-depth, although it does not directly mitigate this specific unauthenticated exploit. Regular vulnerability scanning should be conducted to identify instances where older versions are still in use, and patch management processes must be optimized to ensure timely deployment of security fixes from Oracle. Monitoring logs for unusual patterns of RDP connections or sudden host crashes can also aid in early detection of exploitation attempts while mitigation strategies are being implemented.