PT-2026-3729

CVE-2026-21982

Published

2026-01-01

Updated

2026-05-12

Description by

CVSS 3.1

7.5

High

MetricsAV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions 7.1.14 and 7.2.4

Description A difficult to exploit issue exists in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). An unauthenticated attacker with access to the physical communication segment attached to the hardware where Oracle VM VirtualBox executes can compromise the software. Successful attacks can result in a takeover of Oracle VM VirtualBox.

Recommendations Update Oracle VM VirtualBox to a version later than 7.1.14. Update Oracle VM VirtualBox to a version later than 7.2.4.

Exploitability

Fix

Impacts

Researchers

Ao Wang

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

CWE-284: Improper Access Control

Related identifiers