Exploitable Vulnerability in Oracle VM VirtualBox from Oracle
CVE-2026-21981

4.6MEDIUM

Key Information:

Vendor

Oracle
Status
Oracle Vm Virtualbox
Vendor
CVE Published:
20 January 2026

What is CVE-2026-21981?

A vulnerability in Oracle VM VirtualBox allows a high privileged attacker with access to the infrastructure where it operates to compromise the system. This flaw affects versions 7.1.14 and 7.2.4 and can lead to unauthorized reading of sensitive data as well as the potential for a partial denial of service. The vulnerability's exploitation could extend its impact beyond Oracle VM VirtualBox, affecting interconnected systems and applications.

Affected Version(s)

Oracle VM VirtualBox 7.1.14

Oracle VM VirtualBox 7.2.4

References

https://www.oracle.com/security-alerts/cpujan2026.html
vendor-advisory

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.