CVE-2026-47054: Oracle VM VirtualBox Privilege Escalation

CVE-2026-47054 Overview

CVE-2026-47054 is a local privilege escalation vulnerability in Oracle VM VirtualBox version 7.2.12 affecting the Core component on Windows hosts. The flaw allows a low-privileged attacker with local logon access to the host system to compromise the VirtualBox installation. Successful exploitation results in complete takeover of Oracle VM VirtualBox, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update. The vulnerability is categorized under [CWE-269] Improper Privilege Management.

Critical Impact
A local attacker with standard user privileges on a Windows host can escalate privileges and take over Oracle VM VirtualBox, compromising all guest virtual machines and hypervisor operations.

Affected Products

Oracle VM VirtualBox 7.2.12 (Windows host only)
Oracle Virtualization — Core component
Windows host installations of Oracle VM VirtualBox

Discovery Timeline

2026-07-21 - CVE-2026-47054 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47054

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle VM VirtualBox 7.2.12 running on Windows hosts. An attacker with low-privileged local access to the host operating system can exploit the flaw without user interaction. The attack complexity is low, and successful exploitation yields high impact across confidentiality, integrity, and availability. Because the flaw is scoped to the local host, exploitation requires prior access such as an interactive session or an authenticated foothold on the Windows machine. Once triggered, the attacker gains control over the VirtualBox installation and, by extension, the virtualization workloads it manages.

Root Cause

The issue is classified as [CWE-269] Improper Privilege Management. VirtualBox components running on Windows perform privileged operations that do not correctly enforce separation between low-privileged callers and higher-privileged execution contexts. Oracle has not published detailed technical internals in the public advisory, so implementers should consult the Oracle Security Alert - July 2026 for the authoritative description and patch details.

Attack Vector

The attack vector is local. An attacker must first authenticate to the Windows host running VirtualBox. From that position, the attacker interacts with the vulnerable Core component to escalate privileges and compromise the hypervisor. No user interaction from another account is required, and the scope remains unchanged, meaning the impact is contained to the vulnerable component but affects all resources under its control, including guest VMs.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-47054

Indicators of Compromise

Unexpected creation or modification of VirtualBox service binaries and drivers under C:\Program Files\Oracle\VirtualBox\
New or altered VirtualBox kernel driver activity such as VBoxDrv.sys loading from non-standard paths
Unauthorized changes to VirtualBox configuration files (.vbox, .vbox-prev) or VM state files by non-administrative users
Local user accounts spawning VBoxSVC.exe or VBoxManage.exe with anomalous command-line arguments

Detection Strategies

Monitor process lineage where low-privileged users invoke VirtualBox binaries followed by SYSTEM-level child processes
Alert on privilege token elevation events (Windows Event ID 4672, 4688) tied to VirtualBox-related processes
Baseline expected VirtualBox driver and service behavior, and flag deviations such as unexpected IOCTL patterns to VirtualBox drivers

Monitoring Recommendations

Enable Windows command-line auditing and PowerShell logging on all hosts running VirtualBox
Forward endpoint telemetry to a centralized analytics platform to correlate local logon events with VirtualBox process activity
Track installed VirtualBox versions across the fleet and flag any host still running 7.2.12 on Windows

How to Mitigate CVE-2026-47054

Immediate Actions Required

Inventory all Windows hosts running Oracle VM VirtualBox 7.2.12 and prioritize them for patching
Apply the July 2026 Oracle Critical Patch Update as documented in the Oracle Security Alert - July 2026
Restrict interactive logon rights on VirtualBox hosts to trusted administrators only
Audit local user accounts and remove unnecessary standard user access from virtualization hosts

Patch Information

Oracle addressed CVE-2026-47054 in the July 2026 Critical Patch Update. Administrators should upgrade Oracle VM VirtualBox on Windows hosts to the fixed release specified in the Oracle Security Alert - July 2026. Verify the installed version with VBoxManage --version after patching.

Workarounds

Limit local logon access to VirtualBox Windows hosts to reduce the pool of potential attackers
Run VirtualBox on hosts dedicated to virtualization rather than shared multi-user workstations
Enforce application allowlisting to prevent execution of unauthorized binaries on VirtualBox hosts
Where patching is delayed, consider stopping VirtualBox services on hosts that do not require immediate use

bash

# Verify installed VirtualBox version on Windows host
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" --version

# List local users with logon rights (PowerShell)
Get-LocalUser | Where-Object { $_.Enabled -eq $true }

# Stop VirtualBox services if immediate patching is not possible
Stop-Service -Name "VBoxSDS" -Force