Threat Intelligence Database

CVE-2026-71135 is a vulnerability in Oracle VM VirtualBox version 7.2.14 that allows a high privileged attacker with logon access to the host infrastructure to cause a denial of service by hanging or repeatedly crashing the Oracle VM VirtualBox process. The vulnerability impacts availability and has a CVSS 3.1 base score of 6.0. This vulnerability may also affect additional products due to scope change. No known exploits are reported in the wild. Oracle has included this fix in their August 2026 Critical Security Patch Update.

CVE-2026-71127 is a vulnerability in Oracle VM VirtualBox version 7.2.14 that allows a high privileged attacker with logon access to cause a denial of service by hanging or crashing the software. The vulnerability impacts availability and may affect additional products due to scope change. The CVSS 3.1 base score is 6.0, indicating a medium severity issue.

CVE-2026-71114 is a vulnerability in Oracle VM VirtualBox version 7.2.14 that allows a high privileged attacker with local access to the infrastructure to compromise the VirtualBox environment. The vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle VM VirtualBox. The vulnerability has a CVSS 3.1 base score of 6.0, indicating a medium severity with significant confidentiality impact. The vulnerability affects only version 7.2.14 of Oracle VM VirtualBox. Oracle has published a Critical Security Patch Update advisory that includes this vulnerability among many others, recommending customers apply patches promptly.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Windows host only. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-47041 is a vulnerability in Oracle VM VirtualBox version 7.2.12 that allows a high privileged attacker with logon access to the host infrastructure to cause a denial of service by hanging or crashing the VirtualBox application. The vulnerability affects the core component and can impact additional products due to scope change. The CVSS 3.1 base score is 6.0, indicating a medium severity with a focus on availability impact. No official patch or remediation level has been confirmed yet according to the vendor advisory.

CVE-2026-46816 is a vulnerability in Oracle VM VirtualBox version 7.2.8 affecting the VMSVGA device component. It allows a high privileged attacker with local access to the infrastructure running VirtualBox to compromise the product and gain unauthorized read access to some accessible data. The vulnerability has a low CVSS score of 3.2, indicating limited confidentiality impact without integrity or availability effects. Oracle has published a Critical Security Patch Update advisory recommending timely patching and privilege management to mitigate risks.

CVE-2026-46815 is a vulnerability in Oracle VM VirtualBox version 7.2.8 affecting the VMSVGA device component. It allows a high privileged attacker with logon access to the infrastructure running Oracle VM VirtualBox to compromise the product, potentially impacting additional Oracle products. Successful exploitation can lead to unauthorized read access to some Oracle VM VirtualBox accessible data. The vulnerability has a low severity with a CVSS 3.1 base score of 3.2, indicating limited confidentiality impact and no integrity or availability impact. Oracle has not explicitly stated a patch or fix for this specific version in the advisory but strongly recommends applying Critical Security Patch Updates promptly to mitigate risks. No known exploits are reported in the wild at this time.

CVE-2026-35275 is a high-severity vulnerability in Oracle VM VirtualBox version 7.2.8 affecting the Shared Folders component. It allows a low privileged attacker with logon access to the host infrastructure to compromise Oracle VM VirtualBox. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data accessible by Oracle VM VirtualBox, impacting confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 7.5. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update, strongly recommending patch application to mitigate risk.