CVE-2026-47044: Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. in Oracle Corporation Oracle VM VirtualBox
CVE-2026-47044 is a vulnerability in Oracle VM VirtualBox version 7.2.12 that allows a low privileged attacker with logon access to cause a hang or repeated crash, resulting in a denial of service. The vulnerability impacts availability but does not affect confidentiality or integrity. The CVSS 3.1 base score is 5.5, indicating medium severity. No official patch or remediation level is specified in the advisory, and no known exploits are reported in the wild. Oracle's July 2026 Critical Patch Update advisory does not explicitly mention a fix for this specific version or vulnerability. Users should monitor Oracle advisories for updates and apply patches promptly when available.
AI Analysis
Technical Summary
CVE-2026-47044 affects Oracle VM VirtualBox 7.2.12 and allows a low privileged attacker who can log on to the host infrastructure to cause a hang or frequent crash of the VirtualBox software, resulting in a complete denial of service. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The CVSS vector indicates local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high impact on availability. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch or remediation for this vulnerability. No known exploits have been reported in the wild.
Potential Impact
Successful exploitation results in denial of service by causing Oracle VM VirtualBox to hang or crash repeatedly. There is no impact on confidentiality or integrity. The attack requires local access with low privileges. This can disrupt availability of virtualized environments running on the affected version.
Mitigation Recommendations
Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory and subsequent updates for current remediation guidance. Oracle strongly recommends applying security patches promptly when they become available. Until a patch is released, restrict access to the infrastructure hosting Oracle VM VirtualBox to trusted users only to reduce risk.
CVE-2026-47044: Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. in Oracle Corporation Oracle VM VirtualBox
Description
CVE-2026-47044 is a vulnerability in Oracle VM VirtualBox version 7.2.12 that allows a low privileged attacker with logon access to cause a hang or repeated crash, resulting in a denial of service. The vulnerability impacts availability but does not affect confidentiality or integrity. The CVSS 3.1 base score is 5.5, indicating medium severity. No official patch or remediation level is specified in the advisory, and no known exploits are reported in the wild. Oracle's July 2026 Critical Patch Update advisory does not explicitly mention a fix for this specific version or vulnerability. Users should monitor Oracle advisories for updates and apply patches promptly when available.
CVSS v3.1
Score 5.5medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-47044 affects Oracle VM VirtualBox 7.2.12 and allows a low privileged attacker who can log on to the host infrastructure to cause a hang or frequent crash of the VirtualBox software, resulting in a complete denial of service. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The CVSS vector indicates local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high impact on availability. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch or remediation for this vulnerability. No known exploits have been reported in the wild.
Potential Impact
Successful exploitation results in denial of service by causing Oracle VM VirtualBox to hang or crash repeatedly. There is no impact on confidentiality or integrity. The attack requires local access with low privileges. This can disrupt availability of virtualized environments running on the affected version.
Mitigation Recommendations
Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory and subsequent updates for current remediation guidance. Oracle strongly recommends applying security patches promptly when they become available. Until a patch is released, restrict access to the infrastructure hosting Oracle VM VirtualBox to trusted users only to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-05-18T15:55:10.318Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fe6cd9c2644c7f8cb08bd
Added to database: 07/21/2026, 21:38:21 UTC
Last enriched: 07/30/2026, 04:41:13 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.