Oracle VM VirtualBox: Local privilege escalation in Core component
Summary
A vulnerability in the Core component of Oracle VM VirtualBox allows a low-privileged local user who can log on to the host to take over the VirtualBox environment. The vendor rates the impact as high for confidentiality, integrity and availability, with a CVSS 3.1 base score of 7.8. Oracle has not published exploitation details, and no public proof of concept or known exploitation was found in the sources reviewed.
Affected
- Oracle VM VirtualBox 7.2.20
- Other versions were not confirmed by the sources; treat 7.2.20 and older 7.2 releases as in scope, and 7.1 as unsupported and in scope.
Fixed in
- Oracle October 2026 Critical Patch Update (fix vehicle)
- VirtualBox 7.2.22 is likely the fixed version, pending Oracle confirmation for this specific CVE.
Workaround
- Unknown. No vendor workaround was found; patching is the mitigation.
- Until patched, limit who can log on to hosts running VirtualBox and remove unneeded accounts.
Exploitation
- No known exploitation.
- Not listed in CISA KEV at the time of research; no public proof of concept found.
- EPSS score is very low (0.00152).
Our recommendation
- Inventory all VirtualBox installations and treat 7.2.20 or older, and any 7.1 installation, as affected.
- Upgrade to the October 2026 release and confirm the fixed version in Oracle's advisory before relying on 7.2.22.
- Prioritise multi-user hosts, developer or lab machines, and hosts where contractors or untrusted users have logon.
- Check distribution packages separately, as Ubuntu lists this CVE as needing evaluation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle CPU October 2026 www.oracle.com
- Oracle blog: October 2026 Critical Patch Update blogs.oracle.com
- CNA record via Vulners vulners.com
- Ubuntu tracker ubuntu.com
- VirtualBox 7.2.22 coverage www.linuxcompatible.org
- Strix (NVD status note) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:26.
Original description (NVD)
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.