CVE-2026-47047: Oracle VM VirtualBox Privilege Escalation

CVE-2026-47047 Overview

CVE-2026-47047 is a high-severity vulnerability in the Core component of Oracle VM VirtualBox, part of Oracle Virtualization. The affected release is Oracle VM VirtualBox version 7.2.12. A low-privileged attacker with a local logon to the host running VirtualBox can exploit the flaw to take over the VirtualBox installation. The issue is classified under CWE-269: Improper Privilege Management and carries a full compromise impact on confidentiality, integrity, and availability. Oracle addressed the vulnerability in the Oracle Critical Patch Update Advisory - July 2026.

Critical Impact
A local, low-privileged attacker can escalate privileges to fully compromise Oracle VM VirtualBox, gaining control over hosted virtual machines and their data.

Affected Products

Oracle VM VirtualBox 7.2.12
Oracle Virtualization (Core component)
Host systems running the affected VirtualBox release across supported operating systems

Discovery Timeline

2026-07-21 - CVE-2026-47047 published to the National Vulnerability Database
2026-07-21 - Oracle Critical Patch Update advisory released for July 2026
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47047

Vulnerability Analysis

The flaw resides in the Core component of Oracle VM VirtualBox 7.2.12, which handles virtualization primitives shared between the hypervisor host process and guest virtual machines. A local user who can authenticate to the host and interact with VirtualBox is able to trigger the defect and obtain control over the VirtualBox product. Successful exploitation results in a takeover, meaning the attacker gains the ability to manipulate the hypervisor state, virtual machine configurations, and any workloads running under it. Impacts to confidentiality, integrity, and availability are all rated High.

Root Cause

The underlying weakness is CWE-269: Improper Privilege Management. The Core component does not correctly constrain the privileges granted to a local, authenticated user context when interacting with VirtualBox interfaces. As a result, actions that should be restricted to administrators or the VirtualBox service context can be invoked by low-privileged users, letting them cross the privilege boundary the hypervisor is intended to enforce.

Attack Vector

Exploitation requires local access (AV:L) and low attack complexity, with no user interaction. The attacker must already possess valid low-privileged credentials on the host where VirtualBox executes. From that context, the attacker interacts with VirtualBox Core interfaces to trigger the privilege management flaw and elevate control to the VirtualBox product itself. No verified public proof-of-concept, exploit code, or evidence of in-the-wild exploitation has been published. Oracle does not disclose technical exploitation details; refer to the Oracle July 2026 CPU advisory for the authoritative fix information.

Detection Methods for CVE-2026-47047

Indicators of Compromise

Unexpected launches or configuration changes of VirtualBox binaries such as VBoxManage, VBoxSVC, or VirtualBox initiated by non-administrative user accounts.
Creation, modification, or export of .vbox machine configuration files by accounts that do not normally administer virtualization workloads.
New or altered VirtualBox extension packs, kernel modules (vboxdrv, vboxnetflt, vboxnetadp), or host-only network interfaces appearing without change-management records.

Detection Strategies

Alert on privilege transitions where a low-privileged user spawns child processes running with elevated tokens under the VirtualBox service context.
Correlate local logon events with subsequent VirtualBox API or CLI activity to identify users interacting with the hypervisor outside of expected administrative windows.
Monitor for anomalous file access to VirtualBox installation directories and per-user .config/VirtualBox or %USERPROFILE%\.VirtualBox folders.

Monitoring Recommendations

Enable process command-line logging on hosts running VirtualBox and forward events to a centralized analytics platform for behavioral review.
Track version inventory for VirtualBox across the fleet to confirm hosts remain on the patched July 2026 CPU release.
Review audit logs for unexpected loading of VirtualBox kernel drivers, particularly on multi-user workstations and shared build servers.

How to Mitigate CVE-2026-47047

Immediate Actions Required

Apply the Oracle patches from the Oracle Critical Patch Update - July 2026 to every host running VirtualBox 7.2.12.
Restrict interactive and remote logon rights on hosts running VirtualBox to a minimal set of trusted administrators.
Audit local group membership, especially the vboxusers group on Linux hosts, and remove accounts that do not require hypervisor access.

Patch Information

Oracle released fixes for CVE-2026-47047 as part of the July 2026 Critical Patch Update. Administrators should upgrade Oracle VM VirtualBox to the version identified in the Oracle July 2026 CPU advisory as superseding 7.2.12. Validate the update on non-production hosts, then roll out across the fleet. After patching, restart VirtualBox services or reboot the host to ensure updated kernel modules are loaded.

Workarounds

Where patching cannot be performed immediately, uninstall or disable VirtualBox on hosts that do not require virtualization.
Restrict who can log on locally to VirtualBox hosts, and enforce multi-factor authentication for privileged access.
Remove non-administrative users from the vboxusers group and revoke access to VirtualBox binaries via file system ACLs until the patch is applied.

bash

# Configuration example: restrict VirtualBox access on Linux hosts
# Verify installed version
VBoxManage --version

# Remove non-admin users from the vboxusers group
sudo gpasswd -d <username> vboxusers

# Restrict execution of VirtualBox binaries to administrators
sudo chown root:vboxadmins /usr/lib/virtualbox/VBoxManage
sudo chmod 750 /usr/lib/virtualbox/VBoxManage

# After applying the July 2026 CPU patch, reload the kernel modules
sudo /sbin/vboxconfig