CVE-2026-21986

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)

High · published January 20, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
9.7
In the wild
Unconfirmed
What it is

⚡ An unauthenticated attacker just needs to log in to the infrastructure where Oracle VM VirtualBox runs to exploit this vulnerability! Think of it like a roller coaster ride where a mechanic can make changes from the control booth — if the security procedures are lax, a rogue operator could cause the ride to stall or crash, leaving everyone hanging! An attacker can disrupt Oracle VM VirtualBox operations by causing it to hang or crash repeatedly, leading to total downtime for your Windows VMs. This denial-of-service (DoS) attack could mean significant interruptions for users relying on these virtual machines, impacting productivity and potentially leading to data loss.

Put simply

Think of it like a roller coaster ride where a mechanic can make changes from the control booth — if the security procedures are lax, a rogue operator could cause the ride to stall or crash, leaving everyone hanging! This vulnerability in Oracle VM VirtualBox allows an unauthenticated attacker, with access to the execution environment, to compromise the virtualization service, resulting in a complete service failure.

What to do

An attacker can disrupt Oracle VM VirtualBox operations by causing it to hang or crash repeatedly, leading to total downtime for your Windows VMs. This denial-of-service (DoS) attack could mean significant interruptions for users relying on these virtual machines, impacting productivity and potentially leading to data loss. Update Oracle VM VirtualBox to version 7.1.15 or 7.2.5 to patch this vulnerability. Additionally, review your security configurations and ensure that only trusted users have access to infrastructure where VirtualBox is deployed. Regular audits can help catch similar vulnerabilities early. You've got this! Stay ahead of the game and patch up — your security hero status is activated! 🛡️

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00203 · 9.7th percentile
Published
2026-01-20T21:56Z
EPSS history
Timeline
  • 20 JAN 21:56Z
    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
    cvelistv5