CVE-2026-87322 is a high-severity vulnerability in Oracle VM VirtualBox version 7.2.20. It allows a high privileged attacker with access to the physical communication segment attached to the hardware running VirtualBox to compromise the virtualization software. Successful exploitation can lead to a complete takeover of Oracle VM VirtualBox, affecting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 8.4 and involves a scope change potentially impacting additional products.
CVE-2026-87311 is a vulnerability in Oracle VM VirtualBox version 7.2.16 that allows a low privileged attacker with logon access to cause a denial of service (DoS) by triggering a hang or repeated crash. The vulnerability is difficult to exploit and impacts availability without compromising confidentiality or integrity. The vulnerability has a CVSS 3.1 base score of 5.6 and affects only version 7.2.16 of Oracle VM VirtualBox.
CVE-2026-87303 is a vulnerability in Oracle VM VirtualBox version 7.2.16 that allows a low privileged attacker with logon access to cause a denial of service. Exploitation requires user interaction from someone other than the attacker. Successful exploitation can cause Oracle VM VirtualBox to hang or crash repeatedly, impacting availability. The vulnerability has a CVSS 3.1 base score of 5.9, indicating a medium severity level.
CVE-2026-101598 is a vulnerability in Oracle VM VirtualBox version 7.2.20 that allows a low privileged attacker with logon access to the host infrastructure to compromise the VirtualBox software. Successful exploitation can lead to full takeover of Oracle VM VirtualBox. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products.
A vulnerability exists in Oracle VM VirtualBox version 7.2.16 on Windows hosts that allows a low privileged attacker with logon access to compromise the VirtualBox software. The vulnerability has a high CVSS score of 7.8, impacting confidentiality, integrity, and availability. Multiple older versions are also affected. Oracle has released security patches as part of its Critical Security Patch Update program and strongly recommends prompt application of these patches.
A vulnerability in Oracle VM VirtualBox version 7.2.16 and multiple older versions allows a high privileged local attacker, requiring user interaction, to cause a denial of service by crashing or hanging the application. This impacts availability but does not affect confidentiality or integrity. The CVSS 3.1 base score is 4.2, indicating medium severity. Oracle strongly recommends applying security patches promptly, though no explicit patch information is provided in the advisory.
A vulnerability in Oracle VM VirtualBox version 7.2.16 allows a high privileged attacker with logon access to cause a denial of service by hanging or crashing the product. This affects availability but does not impact confidentiality or integrity. The CVSS 3.1 base score is 6.0, indicating medium severity. Oracle strongly recommends applying security patches promptly. No specific patch information for this vulnerability is provided in the advisory.
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 3.2 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L).
CVE-2026-71135 is a vulnerability in Oracle VM VirtualBox version 7.2.14 that allows a high privileged attacker with logon access to the host infrastructure to cause a denial of service by hanging or repeatedly crashing the Oracle VM VirtualBox process. The vulnerability impacts availability and has a CVSS 3.1 base score of 6.0. This vulnerability may also affect additional products due to scope change. No known exploits are reported in the wild. Oracle has included this fix in their August 2026 Critical Security Patch Update.
CVE-2026-71127 is a vulnerability in Oracle VM VirtualBox version 7.2.14 that allows a high privileged attacker with logon access to cause a denial of service by hanging or crashing the software. The vulnerability impacts availability and may affect additional products due to scope change. The CVSS 3.1 base score is 6.0, indicating a medium severity issue.
CVE-2026-71114 is a vulnerability in Oracle VM VirtualBox version 7.2.14 that allows a high privileged attacker with local access to the infrastructure to compromise the VirtualBox environment. The vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle VM VirtualBox. The vulnerability has a CVSS 3.1 base score of 6.0, indicating a medium severity with significant confidentiality impact. The vulnerability affects only version 7.2.14 of Oracle VM VirtualBox. Oracle has published a Critical Security Patch Update advisory that includes this vulnerability among many others, recommending customers apply patches promptly.
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Windows host only. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-47041 is a vulnerability in Oracle VM VirtualBox version 7.2.12 that allows a high privileged attacker with logon access to the host infrastructure to cause a denial of service by hanging or crashing the VirtualBox application. The vulnerability affects the core component and can impact additional products due to scope change. The CVSS 3.1 base score is 6.0, indicating a medium severity with a focus on availability impact. No official patch or remediation level has been confirmed yet according to the vendor advisory.
CVE-2026-46816 is a vulnerability in Oracle VM VirtualBox version 7.2.8 affecting the VMSVGA device component. It allows a high privileged attacker with local access to the infrastructure running VirtualBox to compromise the product and gain unauthorized read access to some accessible data. The vulnerability has a low CVSS score of 3.2, indicating limited confidentiality impact without integrity or availability effects. Oracle has published a Critical Security Patch Update advisory recommending timely patching and privilege management to mitigate risks.
CVE-2026-46815 is a vulnerability in Oracle VM VirtualBox version 7.2.8 affecting the VMSVGA device component. It allows a high privileged attacker with logon access to the infrastructure running Oracle VM VirtualBox to compromise the product, potentially impacting additional Oracle products. Successful exploitation can lead to unauthorized read access to some Oracle VM VirtualBox accessible data. The vulnerability has a low severity with a CVSS 3.1 base score of 3.2, indicating limited confidentiality impact and no integrity or availability impact. Oracle has not explicitly stated a patch or fix for this specific version in the advisory but strongly recommends applying Critical Security Patch Updates promptly to mitigate risks. No known exploits are reported in the wild at this time.
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L).
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 4.6 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:L).