CVE-2026-71130 is a vulnerability in the core component of Oracle VM VirtualBox version 7.2.14. It allows an unauthenticated attacker with network access via RDP to gain unauthorized access to critical data and perform unauthorized updates, inserts, or deletes on some accessible data. The vulnerability has a CVSS 3.1 base score of 8.2 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with low integrity impact. The vulnerability affects multiple specific versions of VirtualBox as listed, including many older versions. The Oracle advisory references a Critical Security Patch Update for August 2026 but does not explicitly confirm a patch for this VirtualBox vulnerability, recommending customers apply patches promptly.

Successful exploitation can result in unauthorized access to critical data and unauthorized modification (update, insert, delete) of some Oracle VM VirtualBox accessible data. There is no reported impact on system availability. The vulnerability is exploitable remotely without authentication via RDP, increasing risk. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed—check the Oracle advisory and Critical Security Patch Update documentation for current patch availability and installation instructions. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle VM VirtualBox RDP interfaces to trusted users only.