Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVE-2026-71140)
A vulnerability exists in Oracle VM VirtualBox version 7.2.14 that allows a high privileged attacker with local access to compromise the product. The flaw permits unauthorized read and modification access to some data accessible by Oracle VM VirtualBox. The CVSS 3.1 base score is 3.4, indicating a medium severity impact primarily affecting confidentiality and integrity.
AI Analysis
Technical Summary
CVE-2026-71140 is a vulnerability in the core component of Oracle VM VirtualBox version 7.2.14. It allows an attacker with high privileges and local access to the infrastructure running VirtualBox to perform unauthorized updates, inserts, or deletions of accessible data, as well as unauthorized reading of some data. The vulnerability has a CVSS 3.1 base score of 3.4, with attack vector local, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.
Potential Impact
Successful exploitation can lead to unauthorized modification and reading of data accessible by Oracle VM VirtualBox. This could compromise the confidentiality and integrity of data managed by the product. The vulnerability requires the attacker to have high privileges and local access, limiting the attack surface. There is no impact on availability reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Oracle advisory linked does not explicitly mention a patch for this specific VirtualBox vulnerability. Oracle strongly recommends applying available security patches promptly and remaining on actively supported versions. Users should monitor Oracle's Critical Patch Updates for any forthcoming fixes related to this issue.
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVE-2026-71140)
Description
A vulnerability exists in Oracle VM VirtualBox version 7.2.14 that allows a high privileged attacker with local access to compromise the product. The flaw permits unauthorized read and modification access to some data accessible by Oracle VM VirtualBox. The CVSS 3.1 base score is 3.4, indicating a medium severity impact primarily affecting confidentiality and integrity.
CVSS v3.1
Score 3.4low
Affected software
pkg:deb/ubuntu/virtualbox?arch=source&distro=xenialpkg:deb/ubuntu/virtualbox?arch=source&distro=bionicpkg:deb/ubuntu/virtualbox?arch=source&distro=focalpkg:deb/ubuntu/virtualbox?arch=source&distro=jammypkg:deb/ubuntu/virtualbox?arch=source&distro=noblepkg:deb/ubuntu/virtualbox?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-71140 is a vulnerability in the core component of Oracle VM VirtualBox version 7.2.14. It allows an attacker with high privileges and local access to the infrastructure running VirtualBox to perform unauthorized updates, inserts, or deletions of accessible data, as well as unauthorized reading of some data. The vulnerability has a CVSS 3.1 base score of 3.4, with attack vector local, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.
Potential Impact
Successful exploitation can lead to unauthorized modification and reading of data accessible by Oracle VM VirtualBox. This could compromise the confidentiality and integrity of data managed by the product. The vulnerability requires the attacker to have high privileges and local access, limiting the attack surface. There is no impact on availability reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Oracle advisory linked does not explicitly mention a patch for this specific VirtualBox vulnerability. Oracle strongly recommends applying available security patches promptly and remaining on actively supported versions. Users should monitor Oracle's Critical Patch Updates for any forthcoming fixes related to this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-71140
- Osv Schema Version
- 1.7.0
- Aliases
- []
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a870a94acd9273b49b5a516
Added to database: 08/20/2026, 14:09:24 UTC
Last enriched: 08/20/2026, 15:09:26 UTC
Last updated: 08/20/2026, 20:51:58 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.