CVE-2025-62588
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions affected are 7.1.12 and 7.2.2. An easily exploitable vulnerability allows a high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise it. Successful attacks can result in takeover of Oracle VM VirtualBox, and attacks may significantly impact additional products (scope change).
Risk Assessment
A high-privileged local attacker can take over Oracle VM VirtualBox and impact other products, potentially breaching confidentiality, integrity, and availability. CVSS 3.1 Base Score 8.2 indicates high risk.
Recommendation
Update Oracle VM VirtualBox to a patched version and limit the number of high-privilege accounts on virtualization hosts. Monitor for unusual activity within virtual machines and the host.
Other vulnerabilities in Oracle VM VirtualBox
See all- CVE-2026-21990High
A vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is easily exploitable by a high privileged attacker with logon to the infrastructure where VirtualBox executes. Successful attacks can result in takeover of VirtualBox, and may significantly impact additional products (scope change). CVSS 3.1 Base Score is 8.2.
- CVE-2026-21989High
A vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is easily exploitable by a high privileged attacker with logon to the infrastructure where VirtualBox executes. Successful attacks can result in unauthorized creation, deletion or modification of data, unauthorized access to data, and partial denial of service. CVSS 3.1 Base Score is 8.1.
- CVE-2026-21988High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, and the attack may impact other products (scope change).
- CVE-2026-21987High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, and the attack may impact other products (scope change).
- CVE-2026-21986High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An unauthenticated attacker with local access can cause a hang or frequently repeatable crash (complete DoS) of VirtualBox. This vulnerability applies to Windows VMs only.
- CVE-2026-21984High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, but exploitation is difficult. The attack may impact other products (scope change).
- CVE-2026-21983High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, but exploitation is difficult. The attack may impact other products (scope change).
- CVE-2026-21982High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An unauthenticated attacker with access to the physical communication segment attached to the hardware where VirtualBox executes can take over VirtualBox. Exploitation is difficult.
- CVE-2026-21957High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is difficult to exploit, requires high-privileged local access, but can lead to full takeover of VirtualBox. Attacks may impact additional products (scope change).
- CVE-2026-21956High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An attacker with high privileges and local access to the infrastructure can easily exploit this flaw, potentially leading to takeover of Oracle VM VirtualBox. The vulnerability has a scope change, meaning attacks may also impact additional products.
Original NVD description (English source)
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS