CVE-2026-21990

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)

High · published January 20, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
11.0
In the wild
Unconfirmed
What it is

🚨 A crafty intruder with a valid account can hijack Oracle VM VirtualBox and wreak havoc, all thanks to a vulnerability in versions 7.1.14 and 7.2.4! ⚡ Think of this like a tech-savvy thief who knows the building's layout and can slip past security to take control of the entire floor — once in, they can access and manipulate everything! An attacker could take over Oracle VM VirtualBox, compromising not just the virtual machine management but potentially affecting any applications running on it. This could lead to a complete system takeover, putting your data and services in serious jeopardy!

Put simply

Think of this like a tech-savvy thief who knows the building's layout and can slip past security to take control of the entire floor — once in, they can access and manipulate everything! This vulnerability allows a high-privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs to completely compromise it, leading to significant impacts on confidentiality, integrity, and availability.

What to do

An attacker could take over Oracle VM VirtualBox, compromising not just the virtual machine management but potentially affecting any applications running on it. This could lead to a complete system takeover, putting your data and services in serious jeopardy! Patch your Oracle VM VirtualBox to version 7.2.5 or later immediately to avert this risk. Additionally, review access controls and limit accounts with high privileges to minimize potential exposure. 🛡️ You've got this! With these steps, you'll tighten your defenses and keep your virtual environment secure! 🔒✨

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00213 · 11.0th percentile
Published
2026-01-20T21:56Z
EPSS history
Timeline
  • 20 JAN 21:56Z
    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
    cvelistv5