Vulnerability in Oracle VM VirtualBox Core Component
CVE-2026-101599

7.5HIGH

Key Information:

Vendor

Oracle
Status
Oracle Vm Virtualbox
Vendor
CVE Published:
20 October 2026

What is CVE-2026-101599?

A vulnerability exists in the Oracle VM VirtualBox product, specifically in the Core component, which affects version 7.2.20. This weakness allows an attacker with low privileges, already logged into the infrastructure where Oracle VM VirtualBox runs, to potentially compromise the software. Exploiting this vulnerability requires human interaction from another user, heightening the intricacies of the attack. While the primary focus is on Oracle VM VirtualBox, successful exploitation could lead to significant ramifications across additional interconnected products. The implications of this vulnerability could include unauthorized takeover of Oracle VM VirtualBox and risks to confidentiality, integrity, and availability within the affected environment.

Affected Version(s)

Oracle VM VirtualBox 7.2.20

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.