CVE-2026-21984

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)

High · published January 20, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
13.0
In the wild
Unconfirmed
What it is

⚡ A high-privilege attacker with logon access can take control of Oracle VM VirtualBox—talk about a virtual house party gone wrong! 🔥 This vulnerability is like a trusted guest at a gathering who manages to sneak past the bouncers and take over the DJ booth—once they’re in, they can change the whole vibe of the party. 🥳 If exploited, this vulnerability could allow an attacker to completely seize control of Oracle VM VirtualBox, potentially leading to unauthorized access, data breaches, and system damage across interconnected products. It's like entrusting the keys to your home to someone you thought was a friend, only to find they've changed the locks!

Put simply

This vulnerability is like a trusted guest at a gathering who manages to sneak past the bouncers and take over the DJ booth—once they’re in, they can change the whole vibe of the party. 🥳 The vulnerability lies within the Oracle VM VirtualBox core, where an attacker with high privileges can compromise the system, impacting confidentiality, integrity, and availability. Essentially, the attacker can execute malicious actions due to insufficient isolation between the guest and host environments.

What to do

If exploited, this vulnerability could allow an attacker to completely seize control of Oracle VM VirtualBox, potentially leading to unauthorized access, data breaches, and system damage across interconnected products. It's like entrusting the keys to your home to someone you thought was a friend, only to find they've changed the locks! To safeguard your systems, immediately upgrade Oracle VM VirtualBox to versions 7.1.15 or 7.2.5 or later. Additionally, enforce strict access controls to limit who can log on to the infrastructure where Oracle VM VirtualBox is running. 🛡️ You've got this! Stay proactive and secure your virtual environments with these steps! 🚀

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00230 · 13.0th percentile
Published
2026-01-20T21:56Z
EPSS history
Timeline
  • 20 JAN 21:56Z
    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
    cvelistv5