CVE-2026-87267: Oracle VM VirtualBox DOS Vulnerability

CVE-2026-87267 Overview

CVE-2026-87267 is a denial-of-service vulnerability in the Core component of Oracle VM VirtualBox, part of Oracle Virtualization. The flaw affects supported version 7.2.16. A low-privileged attacker with network access via the Remote Desktop Protocol (RDP) can trigger a hang or repeatable crash of the VirtualBox process. Exploitation is rated difficult, and the impact is limited to availability. No confidentiality or integrity impact is reported by Oracle.

Critical Impact
Successful exploitation causes a complete denial of service of the Oracle VM VirtualBox instance, disrupting hosted virtual machines and any dependent workloads.

Affected Products

Oracle VM VirtualBox 7.2.16
Oracle Virtualization (Core component)
Deployments exposing the VirtualBox RDP server (VRDP)

Discovery Timeline

2026-09-15 - CVE-2026-87267 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87267

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle VM VirtualBox and is reachable across the network through the RDP interface exposed by the VirtualBox Remote Desktop Extension. An authenticated attacker with low privileges can send crafted RDP traffic that causes the VirtualBox process to hang or crash repeatedly. The result is a complete loss of availability for the affected hypervisor instance and any guests it hosts.

Oracle classifies exploitation as difficult, indicating that specific timing, protocol state, or environmental conditions are required to reliably trigger the fault. The impact is scoped to the vulnerable VirtualBox process; there is no cross-tenant escape or data exposure documented in the advisory.

Root Cause

Oracle has not published a detailed root-cause analysis. The advisory identifies the Core component as the affected subsystem and RDP as the network-reachable path. Because no CWE identifier or patch diff is disclosed, the underlying defect class is not publicly attributed. Consult the Oracle Security Alert CSPUSEP2026 for vendor-authoritative details.

Attack Vector

The attack requires network access to the VirtualBox RDP listener and valid low-privileged credentials on the target. An adversary that meets these prerequisites can transmit malformed or state-abusing RDP messages to induce the denial-of-service condition. Environments that expose VRDP beyond trusted management networks materially increase reachable attack surface.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-87267

Indicators of Compromise

Unexpected termination or unresponsiveness of the VBoxHeadless or VirtualBox process coinciding with inbound RDP sessions.
Repeated crash dumps or watchdog restarts of VirtualBox instances that expose VRDP listeners.
Authenticated RDP connections from unexpected source addresses to VirtualBox hosts.

Detection Strategies

Monitor host telemetry for VirtualBox process crashes correlated with active RDP sessions on VRDP ports.
Alert on repeated authentication events from a single low-privileged account to the VirtualBox RDP service within short intervals.
Track guest VM state transitions to Aborted or PoweredOff that align with external RDP connection attempts.

Monitoring Recommendations

Forward VirtualBox host logs and process crash events to a centralized SIEM for correlation with network flow data.
Baseline normal VRDP session duration and volume, then alert on statistical deviations.
Instrument availability monitoring on hosted guests to detect service disruption originating from hypervisor faults.

How to Mitigate CVE-2026-87267

Immediate Actions Required

Inventory all Oracle VM VirtualBox 7.2.16 deployments and identify which expose the VRDP listener.
Restrict network reachability of the VirtualBox RDP service to trusted management networks or jump hosts only.
Rotate and audit credentials that can authenticate to the VirtualBox RDP interface, removing unused low-privileged accounts.

Patch Information

Apply the fixes referenced in the Oracle Security Alert CSPUSEP2026. Oracle publishes remediated builds through its standard Critical Patch Update and Security Alert distribution channels; update Oracle VM VirtualBox to a version released after the advisory that explicitly addresses this issue.

Workarounds

Disable the VirtualBox Remote Desktop Extension on hosts that do not require remote console access.
Place VirtualBox hosts behind a firewall that restricts inbound access to the VRDP port to a minimal allowlist.
Require VPN or bastion-host access before permitting any RDP session to VirtualBox hypervisors.

bash

# Disable VRDE on a specific VM to remove the network-reachable attack surface
VBoxManage modifyvm "<vm-name>" --vrde off

# Verify current VRDE status for all VMs
VBoxManage list vms | awk -F'"' '{print $2}' | \
  xargs -I{} sh -c 'echo "VM: {}"; VBoxManage showvminfo "{}" | grep -i VRDE'