Vulnerability in Oracle VM VirtualBox Product by Oracle
CVE-2026-21985

6MEDIUM

Key Information:

Vendor

Oracle
Status
Oracle Vm Virtualbox
Vendor
CVE Published:
20 January 2026

What is CVE-2026-21985?

An exploitable vulnerability exists in Oracle VM VirtualBox, enabling a high-privileged attacker with access to the executing infrastructure to compromise the system. While this flaw is isolated to Oracle VM VirtualBox, its successful exploitation could lead to unauthorized access to sensitive data or comprehensive control over all data accessible via Oracle VM VirtualBox. The affected versions include 7.1.14 and 7.2.4.

Affected Version(s)

Oracle VM VirtualBox 7.1.14

Oracle VM VirtualBox 7.2.4

References

https://www.oracle.com/security-alerts/cpujan2026.html
vendor-advisory

CVSS V3.1

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.