Oracle VM VirtualBox vulnerabilities
75 known CVE vulnerabilities in Oracle VM VirtualBox, translated and rated.
- CVE-2026-21990High
A vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is easily exploitable by a high privileged attacker with logon to the infrastructure where VirtualBox executes. Successful attacks can result in takeover of VirtualBox, and may significantly impact additional products (scope change). CVSS 3.1 Base Score is 8.2.
- CVE-2026-21989High
A vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is easily exploitable by a high privileged attacker with logon to the infrastructure where VirtualBox executes. Successful attacks can result in unauthorized creation, deletion or modification of data, unauthorized access to data, and partial denial of service. CVSS 3.1 Base Score is 8.1.
- CVE-2026-21988High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, and the attack may impact other products (scope change).
- CVE-2026-21987High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, and the attack may impact other products (scope change).
- CVE-2026-21986High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An unauthenticated attacker with local access can cause a hang or frequently repeatable crash (complete DoS) of VirtualBox. This vulnerability applies to Windows VMs only.
- CVE-2026-21984High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, but exploitation is difficult. The attack may impact other products (scope change).
- CVE-2026-21983High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, but exploitation is difficult. The attack may impact other products (scope change).
- CVE-2026-21982High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An unauthenticated attacker with access to the physical communication segment attached to the hardware where VirtualBox executes can take over VirtualBox. Exploitation is difficult.
- CVE-2026-21957High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is difficult to exploit, requires high-privileged local access, but can lead to full takeover of VirtualBox. Attacks may impact additional products (scope change).
- CVE-2026-21956High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An attacker with high privileges and local access to the infrastructure can easily exploit this flaw, potentially leading to takeover of Oracle VM VirtualBox. The vulnerability has a scope change, meaning attacks may also impact additional products.
- CVE-2026-21955High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can compromise VirtualBox, potentially impacting additional products (scope change).
- CVE-2017-10408High
Vulnerability in the Oracle VM VirtualBox component affecting versions prior to 5.1.30. It allows a high privileged attacker with access to the infrastructure to compromise Oracle VM VirtualBox, potentially leading to hangs or frequent crashes and unauthorized access to data.
- CVE-2017-10407High
Vulnerability in the Oracle VM VirtualBox component affecting versions prior to 5.1.30. It allows a high privileged attacker with access to the infrastructure to compromise Oracle VM VirtualBox, potentially leading to serious availability and data integrity issues.
- CVE-2017-10392High
Vulnerability in the Oracle VM VirtualBox component affecting versions prior to 5.1.30. It allows a high privileged attacker with access to the infrastructure to compromise Oracle VM VirtualBox, potentially leading to serious availability and data integrity issues.
- CVE-2017-10242High
Vulnerability in the Oracle VM VirtualBox component affecting versions prior to 5.1.24. It allows a high privileged attacker with access to the infrastructure to compromise Oracle VM VirtualBox, potentially leading to serious availability and data integrity issues.
- CVE-2017-10241High
A vulnerability in the Oracle VM VirtualBox component allows a high privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs to compromise the software. The attacker can cause hangs or frequent crashes of Oracle VM VirtualBox and gain unauthorized access to data.
- CVE-2017-10240High
Vulnerability in the Oracle VM VirtualBox component allows a high privileged attacker with access to the infrastructure to compromise Oracle VM VirtualBox. The attacker can cause hangs or frequent crashes, as well as unauthorized access to data.
- CVE-2017-10239High
Vulnerability in the Oracle VM VirtualBox component affecting versions prior to 5.1.24. It allows a high privileged attacker with access to the infrastructure to compromise Oracle VM VirtualBox, potentially leading to serious availability and data integrity issues.
- CVE-2017-10238High
Vulnerability in the Oracle VM VirtualBox component affecting versions prior to 5.1.24. It allows a high privileged attacker with access to the infrastructure to compromise Oracle VM VirtualBox, potentially leading to serious availability and data integrity issues.
- CVE-2017-10237High
Vulnerability in the Oracle VM VirtualBox component allows a high privileged attacker with access to the infrastructure to compromise Oracle VM VirtualBox. The attacker can cause hangs or frequent crashes, as well as unauthorized access to data.
- CVE-2017-10236High
Vulnerability in the Oracle VM VirtualBox component affecting versions prior to 5.1.24. It allows a high privileged attacker with access to the infrastructure to compromise Oracle VM VirtualBox, potentially leading to serious availability and data integrity issues.
- CVE-2017-10233High
Vulnerability in the Oracle VM VirtualBox component affecting versions prior to 5.1.24. It allows a low privileged attacker with access to the infrastructure to compromise Oracle VM VirtualBox, potentially leading to hangs or frequent crashes.
- CVE-2017-10210High
Vulnerability in the Oracle VM VirtualBox component affecting versions prior to 5.1.24. It allows a high privileged attacker with access to the infrastructure to compromise Oracle VM VirtualBox, potentially leading to hangs or frequent crashes.
- CVE-2017-10204High
Vulnerability in the Oracle VM VirtualBox component affecting versions prior to 5.1.24. It allows a low privileged attacker to compromise Oracle VM VirtualBox, potentially impacting additional products.
- CVE-2017-10129High
Vulnerability in the Oracle VM VirtualBox component affecting versions prior to 5.1.24. It allows a low privileged attacker with access to the infrastructure to compromise Oracle VM VirtualBox.
- CVE-2017-3587High
A vulnerability in the Oracle VM VirtualBox component related to shared folders allows a low privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs to compromise the software. The attacker can gain unauthorized access to critical data and cause a hang or crash of Oracle VM VirtualBox.
- CVE-2017-3576High
A vulnerability in the Oracle VM VirtualBox component allows a low privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs to take control of the software. Affected versions are prior to 5.0.38 and prior to 5.1.20.
- CVE-2017-3575High
A vulnerability in the Oracle VM VirtualBox component allows a high privileged attacker with access to the infrastructure to compromise Oracle VM VirtualBox. The attacker can unauthorizedly create, delete, or modify data and cause system crashes.
- CVE-2017-3563High
A vulnerability in the Oracle VM VirtualBox component allows a low privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs to take control of the software. Affects versions prior to 5.0.38 and 5.1.20.
- CVE-2017-3561High
Vulnerability in the Oracle VM VirtualBox component allows a low privileged attacker to take control of Oracle VM VirtualBox. Affected versions are prior to 5.0.38 and prior to 5.1.20.
- CVE-2017-3559High
A vulnerability in the Oracle VM VirtualBox component allows a low privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs to compromise the software. The attacker can cause hangs or frequent crashes of Oracle VM VirtualBox and gain unauthorized access to data.
- CVE-2017-3558High
A vulnerability in the Oracle VM VirtualBox component allows an unauthenticated attacker with access to the infrastructure where Oracle VM VirtualBox runs to compromise the software. The attacker can cause hangs or frequent crashes of Oracle VM VirtualBox and gain unauthorized access to data.
- CVE-2017-3538High
A vulnerability in the Oracle VM VirtualBox component related to shared folders allows a low privileged attacker to gain unauthorized access to data. It affects versions prior to 5.0.34 and prior to 5.1.16.
- CVE-2017-3316High
A vulnerability in the Oracle VM VirtualBox component allows a high privileged attacker with network access to compromise Oracle VM VirtualBox. Human interaction is required, making the attack easily exploitable.
- CVE-2016-5501High
An unspecified vulnerability in the Oracle VM VirtualBox component before 5.0.28 and 5.1.x before 5.1.8 allows local users to affect confidentiality, integrity, and availability.
- CVE-2016-5605Critical
Unspecified vulnerability in the Oracle VM VirtualBox component before 5.1.4 in Oracle Virtualization allows remote attackers to affect confidentiality and integrity via vectors related to VRDE.
- CVE-2026-71151Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. Difficult to exploit by low-privileged attacker with logon to infrastructure, allows unauthorized access to critical data or complete access to all data. May impact additional products (scope change). CVSS score 5.6.
- CVE-2026-71141High
Vulnerability in Oracle VM VirtualBox product (component: Core) version 7.2.14. Easily exploitable by unauthenticated attacker with logon to infrastructure, requires user interaction. May impact additional products (scope change). Successful attacks can result in unauthorized creation, deletion or modification access to critical data, unauthorized read access to a subset of data, and partial denial of service. CVSS 7.7.
- CVE-2026-71140Low
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized update, insert or delete access to some data as well as unauthorized read access to a subset of data. CVSS 3.1 Base Score 3.4 (Confidentiality and Integrity impacts).
- CVE-2026-71139Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. Easily exploitable, requires logon to the infrastructure. Allows a high-privileged attacker to cause a hang or frequent crashes (complete DoS) of VirtualBox.
- CVE-2026-71138High
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. A high-privileged attacker with local access can exploit this, potentially causing hangs or frequent crashes (complete DoS) and unauthorized data access.
- CVE-2026-71137Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. Easily exploitable, requires logon to the infrastructure. Allows a high-privileged attacker to cause a hang or frequent crashes (complete DoS) of VirtualBox, and may impact additional products (scope change).
- CVE-2026-71136High
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. A high-privileged attacker with local access can exploit this, potentially causing hangs or frequent crashes (complete DoS) and unauthorized data access.
- CVE-2026-71135Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. Easily exploitable, requires logon to the infrastructure. Allows a high-privileged attacker to cause a hang or frequent crashes (complete DoS) of VirtualBox, and may impact additional products (scope change).
- CVE-2026-71134Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. Easily exploitable, requires logon to the infrastructure. Allows a high-privileged attacker to perform unauthorized modification and read of some data and cause partial denial of service, and may impact additional products (scope change).
- CVE-2026-71132Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. Difficult to exploit, requires logon to the infrastructure. Allows a high-privileged attacker to gain unauthorized access to critical data or complete access to all VirtualBox data, and may impact additional products (scope change).
- CVE-2026-71131High
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. An unauthenticated attacker with local access can exploit this, requiring user interaction, potentially leading to takeover of Oracle VM VirtualBox.
- CVE-2026-71130High
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. An unauthenticated attacker with network access via RDP can exploit this, potentially leading to unauthorized access to critical data and data modification.
- CVE-2026-71129High
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. A high-privileged attacker with local access can exploit this, potentially leading to takeover of Oracle VM VirtualBox.
- CVE-2026-71128Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. Easily exploitable, requires logon to the infrastructure. Allows a high-privileged attacker to cause a hang or frequent crashes (complete DoS) of VirtualBox, and may impact additional products (scope change).

