CVE-2026-87322 in VM VirtualBox
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the core component of Oracle VM VirtualBox version 7.2.20, representing a critical security flaw that compromises the integrity and availability of virtualized environments. This issue is classified as an easily exploitable vulnerability requiring high privileged access for the attacker. The attack vector is specific to physical proximity or network adjacency, necessitating that the adversary has access to the physical communication segment attached to the hardware where Oracle VM VirtualBox executes. This constraint aligns with the CVSS 3.1 Attack Vector designation of Adjacent Network (AV:A), indicating that while remote exploitation over a wide area network is not possible, local or adjacent attackers on the same broadcast domain can leverage this flaw effectively. The requirement for high privilege (PR:H) suggests that the attacker must already possess elevated credentials on the host system or have compromised a privileged account within the virtualized environment to initiate the attack sequence.
The technical nature of this vulnerability allows an authenticated, high-privilege actor to achieve complete takeover of the Oracle VM VirtualBox instance. This level of compromise implies full control over the guest operating systems and potentially the hypervisor itself if isolation boundaries are breached. The operational impact is severe, as reflected by a CVSS Base Score of 8.4 out of 10. The vector string (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) highlights that the vulnerability has low complexity and requires no user interaction, yet it carries significant consequences for confidentiality, integrity, and availability due to a scope change. This means that while the initial target is VirtualBox, the successful exploitation can lead to impacts on additional products or components outside the direct boundary of the vulnerable software, expanding the blast radius beyond the immediate virtual machine environment.
From an industry standards perspective, this vulnerability maps closely to CWE-787: Out-of-bounds Write and potentially CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, depending on the specific memory corruption mechanics involved in the core component. The ability to take over the system aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter if used for post-exploitation activities, or more critically T1068: Exploitation for Privilege Escalation if it facilitates moving from a lower-privilege context within VirtualBox to higher privileges. The scope change aspect is particularly concerning as it indicates that the vulnerability does not respect standard virtualization isolation boundaries, potentially allowing an attacker in one guest VM or on the host network segment to affect other systems connected to the same physical infrastructure.
Mitigation strategies must focus on strict access control and network segmentation given the adjacent network attack vector. Administrators should ensure that only trusted, high-privilege users have access to the management interfaces of Oracle VM VirtualBox hosts. Network architecture should isolate virtualization host traffic from general user networks using VLANs or firewalls to prevent adjacency-based attacks. Furthermore, keeping Oracle VM VirtualBox updated to versions where this core vulnerability is patched is essential. Security monitoring tools should be configured to detect anomalous behavior indicative of privilege escalation attempts within the hypervisor environment. Organizations relying on this virtualization platform must also review their incident response plans to account for potential scope changes that could impact broader infrastructure components beyond individual VMs, ensuring rapid containment and recovery procedures are in place to maintain operational continuity.