Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVE-2026-71141)
A vulnerability in Oracle VM VirtualBox version 7.2.14 allows an unauthenticated attacker with logon access to the infrastructure to compromise the product. Exploitation requires user interaction by a person other than the attacker and can lead to unauthorized creation, deletion, or modification of critical data, unauthorized read access to some data, and partial denial of service. The vulnerability has a CVSS 3.1 base score of 7.7, indicating a medium severity level.
AI Analysis
Technical Summary
CVE-2026-71141 is a vulnerability in the core component of Oracle VM VirtualBox, specifically affecting version 7.2.14. The flaw allows an unauthenticated attacker with logon privileges to the host infrastructure to compromise Oracle VM VirtualBox. Exploitation requires user interaction from a third party. The vulnerability impacts confidentiality (limited), integrity (high), and availability (low), potentially enabling unauthorized data creation, deletion, modification, read access, and partial denial of service. The scope of impact may extend beyond Oracle VM VirtualBox to additional products. The CVSS vector is AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L.
Potential Impact
The vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle VM VirtualBox, unauthorized read access to some data, and partial denial of service. The attack requires user interaction and logon access to the infrastructure but no privileges. The scope of impact is changed, meaning other products may also be affected. The CVSS score of 7.7 reflects a medium severity with significant integrity impact.
Mitigation Recommendations
No explicit patch or remediation details are provided in the vendor advisory content. Patch status is not yet confirmed — check the Oracle Critical Security Patch Update advisories for current remediation guidance and apply updates promptly when available. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate exploitation risks.
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVE-2026-71141)
Description
A vulnerability in Oracle VM VirtualBox version 7.2.14 allows an unauthenticated attacker with logon access to the infrastructure to compromise the product. Exploitation requires user interaction by a person other than the attacker and can lead to unauthorized creation, deletion, or modification of critical data, unauthorized read access to some data, and partial denial of service. The vulnerability has a CVSS 3.1 base score of 7.7, indicating a medium severity level.
CVSS v3.1
Score 7.7high
Affected software
pkg:deb/ubuntu/virtualbox?arch=source&distro=xenialpkg:deb/ubuntu/virtualbox?arch=source&distro=bionicpkg:deb/ubuntu/virtualbox?arch=source&distro=focalpkg:deb/ubuntu/virtualbox?arch=source&distro=jammypkg:deb/ubuntu/virtualbox?arch=source&distro=noblepkg:deb/ubuntu/virtualbox?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-71141 is a vulnerability in the core component of Oracle VM VirtualBox, specifically affecting version 7.2.14. The flaw allows an unauthenticated attacker with logon privileges to the host infrastructure to compromise Oracle VM VirtualBox. Exploitation requires user interaction from a third party. The vulnerability impacts confidentiality (limited), integrity (high), and availability (low), potentially enabling unauthorized data creation, deletion, modification, read access, and partial denial of service. The scope of impact may extend beyond Oracle VM VirtualBox to additional products. The CVSS vector is AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L.
Potential Impact
The vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle VM VirtualBox, unauthorized read access to some data, and partial denial of service. The attack requires user interaction and logon access to the infrastructure but no privileges. The scope of impact is changed, meaning other products may also be affected. The CVSS score of 7.7 reflects a medium severity with significant integrity impact.
Mitigation Recommendations
No explicit patch or remediation details are provided in the vendor advisory content. Patch status is not yet confirmed — check the Oracle Critical Security Patch Update advisories for current remediation guidance and apply updates promptly when available. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate exploitation risks.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-71141
- Osv Schema Version
- 1.7.0
- Aliases
- []
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a870a94acd9273b49b5a514
Added to database: 08/20/2026, 14:09:24 UTC
Last enriched: 08/20/2026, 15:08:42 UTC
Last updated: 08/20/2026, 21:51:58 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.