Oracle VM VirtualBox vulnerabilities
104 known CVE vulnerabilities in Oracle VM VirtualBox, translated and rated.
- CVE-2026-87272High
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The affected supported version is 7.2.16. An easily exploitable vulnerability allows a low-privileged attacker with logon to the infrastructure where VirtualBox executes to compromise it, potentially resulting in takeover.
- CVE-2026-87271High
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The affected supported version is 7.2.16 and applies to Windows hosts only. An easily exploitable vulnerability allows a low-privileged attacker with logon to the infrastructure where VirtualBox executes to compromise it, potentially resulting in takeover.
- CVE-2026-87270High
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The affected supported version is 7.2.16 and applies to Windows hosts only. An easily exploitable vulnerability allows a low-privileged attacker with logon to the infrastructure where VirtualBox executes to compromise it, potentially resulting in takeover.
- CVE-2026-87269High
Vulnerability in Oracle VM VirtualBox (component: Core) affecting version 7.2.16. An easily exploitable flaw allows a low privileged attacker with logon to the infrastructure where VirtualBox runs to take over the product. This vulnerability applies to Windows hosts only.
- CVE-2026-87268High
Vulnerability in Oracle VM VirtualBox (component: Core) affecting version 7.2.16. An easily exploitable flaw allows a low privileged attacker with logon to the infrastructure where VirtualBox runs to take over the product. This vulnerability applies to Windows hosts only.
- CVE-2026-87267Medium
Vulnerability in Oracle VM VirtualBox (Core component) version 7.2.16. A low-privileged attacker with network access via RDP, under difficult exploitation conditions, can cause a hang or frequent crashes (complete DoS).
- CVE-2026-71151Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. Difficult to exploit by low-privileged attacker with logon to infrastructure, allows unauthorized access to critical data or complete access to all data. May impact additional products (scope change). CVSS score 5.6.
- CVE-2026-71141High
Vulnerability in Oracle VM VirtualBox product (component: Core) version 7.2.14. Easily exploitable by unauthenticated attacker with logon to infrastructure, requires user interaction. May impact additional products (scope change). Successful attacks can result in unauthorized creation, deletion or modification access to critical data, unauthorized read access to a subset of data, and partial denial of service. CVSS 7.7.
- CVE-2026-71140Low
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized update, insert or delete access to some data as well as unauthorized read access to a subset of data. CVSS 3.1 Base Score 3.4 (Confidentiality and Integrity impacts).
- CVE-2026-71139Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. Easily exploitable, requires logon to the infrastructure. Allows a high-privileged attacker to cause a hang or frequent crashes (complete DoS) of VirtualBox.
- CVE-2026-71138High
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. A high-privileged attacker with local access can exploit this, potentially causing hangs or frequent crashes (complete DoS) and unauthorized data access.
- CVE-2026-71137Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. Easily exploitable, requires logon to the infrastructure. Allows a high-privileged attacker to cause a hang or frequent crashes (complete DoS) of VirtualBox, and may impact additional products (scope change).
- CVE-2026-71136High
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. A high-privileged attacker with local access can exploit this, potentially causing hangs or frequent crashes (complete DoS) and unauthorized data access.
- CVE-2026-71135Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. Easily exploitable, requires logon to the infrastructure. Allows a high-privileged attacker to cause a hang or frequent crashes (complete DoS) of VirtualBox, and may impact additional products (scope change).
- CVE-2026-71134Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. Easily exploitable, requires logon to the infrastructure. Allows a high-privileged attacker to perform unauthorized modification and read of some data and cause partial denial of service, and may impact additional products (scope change).
- CVE-2026-71132Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. Difficult to exploit, requires logon to the infrastructure. Allows a high-privileged attacker to gain unauthorized access to critical data or complete access to all VirtualBox data, and may impact additional products (scope change).
- CVE-2026-71131High
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. An unauthenticated attacker with local access can exploit this, requiring user interaction, potentially leading to takeover of Oracle VM VirtualBox.
- CVE-2026-71130High
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. An unauthenticated attacker with network access via RDP can exploit this, potentially leading to unauthorized access to critical data and data modification.
- CVE-2026-71129High
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. A high-privileged attacker with local access can exploit this, potentially leading to takeover of Oracle VM VirtualBox.
- CVE-2026-71128Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. Easily exploitable, requires logon to the infrastructure. Allows a high-privileged attacker to cause a hang or frequent crashes (complete DoS) of VirtualBox, and may impact additional products (scope change).
- CVE-2026-71127Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. Easily exploitable, requires logon to the infrastructure. Allows a high-privileged attacker to cause a hang or frequent crashes (complete DoS) of VirtualBox, and may impact additional products (scope change).
- CVE-2026-71126High
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. A low-privileged attacker with local access can exploit this, potentially leading to takeover of Oracle VM VirtualBox.
- CVE-2026-71125Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. Easily exploitable, requires logon to the infrastructure and user interaction. Allows an unauthenticated attacker to cause a hang or frequent crashes (complete DoS) of VirtualBox and unauthorized modification of some data.
- CVE-2026-71116High
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. A high-privileged attacker with local access can exploit this, potentially leading to takeover of Oracle VM VirtualBox.
- CVE-2026-71115Medium
Vulnerability in Oracle VM VirtualBox (Core) in version 7.2.14. A high-privileged attacker with local access can access critical data, and the attack may impact other products (scope change).
- CVE-2026-71114Medium
Vulnerability in Oracle VM VirtualBox (Core) in version 7.2.14. A high-privileged attacker with local access can access critical data, and the attack may impact other products (scope change).
- CVE-2026-71113High
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.14. An unauthenticated attacker with network access via RDP can exploit this, potentially causing hangs or frequent crashes (complete DoS) of Oracle VM VirtualBox.
- CVE-2026-60162Medium
Vulnerability in Oracle VM VirtualBox (component: Core) affects version 7.2.12. A high-privileged attacker with local access can gain unauthorized access to critical data or all VirtualBox data and cause partial denial of service. Attacks may impact additional products (scope change). Exploitation is difficult.
- CVE-2026-60161Medium
Oracle VM VirtualBox version 7.2.12 has a vulnerability in the Core component. An unauthenticated attacker with local access, after tricking a user into interaction, can cause a hang or frequent crashes (complete DOS) and unauthorizedly update, insert, or delete data.
- CVE-2026-60160Low
Vulnerability in Oracle VM VirtualBox 7.2.12 allows a high-privileged attacker with local access to read a subset of data. The attack also impacts additional products.
- CVE-2026-60159High
Vulnerability in Oracle VM VirtualBox (component: Core). A high-privileged attacker with local access can take over VirtualBox, and the attack may affect other products. CVSS 7.5.
- CVE-2026-60158Medium
Oracle VM VirtualBox version 7.2.12 has a vulnerability in the Core component. A low-privileged attacker with local access to the infrastructure can exploit this difficult-to-exploit vulnerability, leading to unauthorized modification of critical data and partial denial of service (DOS) of VirtualBox, also affecting other products.
- CVE-2026-60155High
Vulnerability in Oracle VM VirtualBox (component: Core). A high-privileged attacker with local access can take over VirtualBox, and the attack may affect other products. CVSS 7.5.
- CVE-2026-60150High
Vulnerability in Oracle VM VirtualBox 7.2.12 allows a low-privileged local attacker to take over the virtual machine. The attack is easy to exploit and only requires logon to the system where VirtualBox runs.
- CVE-2026-47062Medium
Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.12. It is easily exploitable, requires local access and low privileges. Successful attack can cause a hang or frequent crashes (full DOS) of VirtualBox.
- CVE-2026-47055Low
A vulnerability in Oracle VM VirtualBox version 7.2.12. Easily exploitable by an attacker with high privileges and local access. May lead to unauthorized data modification in VirtualBox, and attacks may impact additional products (scope change).
- CVE-2026-47054High
Vulnerability in Oracle VM VirtualBox version 7.2.12, component Core. A low-privileged attacker with local access can easily take over VirtualBox. Affects Windows hosts only.
- CVE-2026-47053Medium
Easily exploitable vulnerability in Oracle VM VirtualBox 7.2.12, requiring user interaction. A low-privileged attacker can modify critical data and cause partial denial of service.
- CVE-2026-47050High
Vulnerability in Oracle VM VirtualBox version 7.2.8. A high-privileged attacker with local access, requiring user interaction, can modify critical data and cause a complete denial of service (DOS) via hangs or frequent crashes. The attack may impact other products.
- CVE-2026-47047High
Vulnerability in Oracle VM VirtualBox version 7.2.12, component Core. A low-privileged attacker with local access can easily take over VirtualBox.
- CVE-2026-47044Medium
Vulnerability in Oracle VM VirtualBox version 7.2.12 (Core component). Easily exploitable by an attacker with low privileges and local access. Can cause complete denial of service (DOS) through hangs or frequent crashes.
- CVE-2026-47043Low
Vulnerability in Oracle VM VirtualBox 7.2.12 allows a high-privileged attacker to read a subset of accessible data. The attack requires local access but may affect other products.
- CVE-2026-47041Medium
Vulnerability in Oracle VM VirtualBox 7.2.12 allows a high-privileged attacker with local access to cause a hang or frequent crash (DOS) of the VM. Attacks may impact additional products.
- CVE-2026-46974High
Vulnerability in the Oracle VM VirtualBox product (component: Core) in version 7.2.8, which can be exploited by a high privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs. This allows for takeover of Oracle VM VirtualBox.
- CVE-2026-46874Low
Vulnerability in the Oracle VM VirtualBox product (component: Core) in version 7.2.8. Easily exploitable by a high privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs, potentially compromising the software.
- CVE-2025-62641High
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
- CVE-2025-62592Medium
Vulnerability in Oracle VM VirtualBox (Core component) affects versions 7.1.12 and 7.2.2. A high-privileged authenticated attacker can exploit it locally, potentially leading to unauthorized access to critical data or all data accessible in VirtualBox.
- CVE-2025-62591Medium
Vulnerability in Oracle VM VirtualBox (Core component) affects versions 7.1.12 and 7.2.2. A high-privileged authenticated attacker can exploit it locally, potentially leading to unauthorized access to critical data or all data accessible in VirtualBox.
- CVE-2025-62590High
A vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions affected are 7.1.12 and 7.2.2. An easily exploitable vulnerability allows a high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise it. Successful attacks can result in takeover of Oracle VM VirtualBox, and attacks may significantly impact additional products (scope change).
- CVE-2025-62589High
A vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions affected are 7.1.12 and 7.2.2. An easily exploitable vulnerability allows a high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise it. Successful attacks can result in takeover of Oracle VM VirtualBox, and attacks may significantly impact additional products (scope change).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

