PT-2026-3704

CVE-2026-21956

Published

2026-01-01

Updated

2026-05-12

Description by

CVSS 3.1

8.2

High

MetricsAV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions 7.1.14 and 7.2.4

Description An easily exploitable issue exists in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). A high-privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs can compromise the software. Successful attacks can lead to a takeover of Oracle VM VirtualBox and may significantly impact additional products.

Recommendations Update Oracle VM VirtualBox version 7.1.14 to a newer, fixed version. Update Oracle VM VirtualBox version 7.2.4 to a newer, fixed version.

Exploitability

Fix

Impacts

Researchers

Gangmin Kim

Sangbin Kim

Un3Xploitable

Vendors

Affected products

Weakness enumeration

CWE-400: Uncontrolled Resource Consumption

CWE-20: Improper Input Validation