CVE-2025-62590CWE-267

CVE-2025-62590

High · published October 22, 2025

CVSS v3.1
8.2
EPSS
0%
Percentile
9.9
In the wild
Unconfirmed
What it is

⚡ A high-privilege attacker with access to your infrastructure can take total control of Oracle VM VirtualBox — and it’s alarmingly easy! 🔥 Think of it like a restaurant where a diner with special access can walk into the kitchen and change the entire menu without checks. This vulnerability allows someone with login access to compromise the core system, impacting all the dishes being served to customers! If exploited, an attacker could hijack your Oracle VM VirtualBox, leading to complete control over the virtualization environment. This means they could manipulate, steal, or delete sensitive data, putting your whole operation at risk. A breach like this could disrupt not just the virtual machines but potentially other products relying on this infrastructure.

Put simply

Think of it like a restaurant where a diner with special access can walk into the kitchen and change the entire menu without checks. This vulnerability allows someone with login access to compromise the core system, impacting all the dishes being served to customers! This vulnerability in Oracle VM VirtualBox (versions 7.1.12 and 7.2.2) allows a high-privilege attacker with logon access to compromise the virtualization platform, resulting in a potential full takeover of the system and impacts on confidentiality, integrity, and availability.

What to do

If exploited, an attacker could hijack your Oracle VM VirtualBox, leading to complete control over the virtualization environment. This means they could manipulate, steal, or delete sensitive data, putting your whole operation at risk. A breach like this could disrupt not just the virtual machines but potentially other products relying on this infrastructure. To remediate this vulnerability, update Oracle VM VirtualBox to the latest version as soon as possible. Ensure that only trusted users have logon access to the infrastructure where it runs. Regularly audit permissions to prevent unauthorized access. You've got this! Follow these steps, and you'll strengthen your defenses against this vulnerability. 🛡️

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00205 · 9.9th percentile
Weakness
CWE-267 · Privilege Defined With Unsafe Actions
Published
2025-10-22T00:20Z
Affected products (2)
ProductVersionsFixed in
oracle/vm_virtualboxall versions—
oracle/vm_virtualboxall versions—
References (1)
EPSS history
Timeline
  • 21 OCT 20:03Z
    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
    cvelistv5