CVE-2026-21989

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)

High · published January 20, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
10.5
In the wild
Unconfirmed
What it is

⚡ A high-privileged attacker can exploit this vulnerability with just their login! The Oracle VM VirtualBox's weakness is like a trusted internal employee suddenly going rogue. 🔥 Picture a secure office where one trusted staff member has a spare key to all filing cabinets. If they decide to misuse that key, they could access sensitive information or even alter critical documents—all without anyone noticing at first! If compromised, an attacker could create, delete, or modify any accessible data in Oracle VM VirtualBox, potentially leading to a catastrophic data leak. Even worse, they could partially deny service, leaving your virtualization environment in a precarious state. This is like a trusted employee tampering with crucial files—devastating!

Put simply

Picture a secure office where one trusted staff member has a spare key to all filing cabinets. If they decide to misuse that key, they could access sensitive information or even alter critical documents—all without anyone noticing at first! This vulnerability in Oracle VM VirtualBox allows high-privileged users to manipulate the system, posing a significant risk to data integrity, confidentiality, and service availability.

What to do

If compromised, an attacker could create, delete, or modify any accessible data in Oracle VM VirtualBox, potentially leading to a catastrophic data leak. Even worse, they could partially deny service, leaving your virtualization environment in a precarious state. This is like a trusted employee tampering with crucial files—devastating! Patch immediately to versions 7.2.5 or higher and restrict access to critical infrastructure. Regularly audit user permissions to ensure that only trusted personnel have elevated access. Don't wait—take action now! You can tackle this head-on! Follow these steps, and you'll reinforce your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00209 · 10.5th percentile
Published
2026-01-20T21:56Z
EPSS history
Timeline
  • 20 JAN 21:56Z
    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
    cvelistv5