Oracle VM VirtualBox: Improper access control in Core component
Summary
A flaw in the Core component of Oracle VM VirtualBox (CWE-284, improper access control) allows an attacker to take over VirtualBox. The attacker needs adjacent network access to the physical communication segment of the host and high privileges. Because the scope is changed, the impact may extend beyond VirtualBox, with high impact on confidentiality, integrity and availability (CVSS 3.1: 8.4).
Affected
- Oracle VM VirtualBox 7.2.20 (affected version per the CVE record and Oracle's risk matrix)
- VirtualBox 7.1 lost maintenance support on March 31, 2026. Whether 7.1 is affected is unknown.
Fixed in
- VirtualBox 7.2.22 (fixed version mapped by a third-party Nessus plugin; confirm in Oracle's October 2026 CPU advisory before rollout)
- Oracle's sources reviewed do not name a fixed version for this CVE in its own text.
Workaround
Unknown. No vendor workaround was found. General hardening: restrict who can reach the host's physical network segment and limit administrator rights on the host.
Exploitation
Unknown. No in-the-wild exploitation, public proof of concept or CISA KEV listing was found, but these checks were not exhaustive. CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory all VirtualBox installations, including 7.1 installs.
- Upgrade 7.2 installs to 7.2.22 or later after checking the fixed build in Oracle's advisory. Migrate 7.1 installs to 7.2.
- Check that VirtualBox hosts sit on trusted networks and that administrator rights are limited.
- Re-check CISA KEV and public proof-of-concept sources.
- Priority: medium for most SMEs. Raise it if hosts sit on shared or guest networks or cannot be upgraded.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle October 2026 Critical Patch Update www.oracle.com
- Oracle CPU blog, October 2026 blogs.oracle.com
- Ubuntu CVE tracker ubuntu.com
- NVD record mirror (Vulners) vulners.com
- Nessus plugin mirror for VirtualBox 7.2.22 (Vulners) vulners.com
- Linux Compatible: VirtualBox 7.2.22 release www.linuxcompatible.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:14.
Original description (NVD)
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.