CVE-2026-87268: Oracle VM VirtualBox Privilege Escalation

CVE-2026-87268 Overview

CVE-2026-87268 is a local privilege escalation vulnerability in the Core component of Oracle VM VirtualBox running on Windows hosts. The flaw affects supported version 7.2.16 and is categorized under [CWE-269] Improper Privilege Management. A low-privileged attacker with local logon access to the host where VirtualBox executes can compromise the VirtualBox product, resulting in full takeover with impacts to confidentiality, integrity, and availability. Oracle disclosed the issue in the Oracle Security Alert CSPUSEP2026. No public exploit or proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A local, low-privileged user on a Windows host running Oracle VM VirtualBox 7.2.16 can escalate privileges and fully compromise the VirtualBox product.

Affected Products

Oracle VM VirtualBox 7.2.16 (Windows host only)
Oracle Virtualization product family (Core component)
Windows hosts running the affected VirtualBox release

Discovery Timeline

2026-09-15 - CVE-2026-87268 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-87268

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle VM VirtualBox on Windows hosts. Oracle's advisory classifies the flaw as easily exploitable by a local attacker with valid logon credentials on the host operating system. Successful exploitation leads to takeover of the VirtualBox product with high impact across confidentiality, integrity, and availability. The [CWE-269] classification indicates the underlying weakness is improper privilege management, where a component grants or retains privileges that exceed what its calling context should hold. On Windows hosts, VirtualBox relies on several kernel drivers and privileged services that mediate hypervisor operations, and a defect in this trust boundary can allow a standard user to influence a higher-privileged execution path.

Root Cause

Oracle's advisory attributes the issue to the Core component and maps it to [CWE-269] Improper Privilege Management. This class of flaw typically occurs when a privileged process trusts input, handles, or configuration values controllable by an unprivileged caller. No further technical breakdown has been published by the vendor at this time.

Attack Vector

The attack vector is local. An attacker must first authenticate to the Windows host running VirtualBox. From that low-privileged foothold, they interact with a VirtualBox interface or service that fails to enforce proper privilege separation. No user interaction from a second party is required, and the attack does not cross a security scope boundary in the CVSS model. Exploitation results in compromise of the VirtualBox product itself, which on a Windows host commonly translates into elevated code execution in the context of VirtualBox privileged components.

No verified proof-of-concept code is available for CVE-2026-87268. Refer to the Oracle Security Alert CSPUSEP2026 for authoritative technical details as Oracle publishes additional information.

Detection Methods for CVE-2026-87268

Indicators of Compromise

Unexpected child processes spawned by VirtualBox services (VBoxSVC.exe, VBoxHeadless.exe, VBoxSDS.exe) running with elevated tokens.
Loading or reloading of VirtualBox kernel drivers (VBoxDrv.sys, VBoxNetAdp.sys, VBoxNetLwf.sys, VBoxUSBMon.sys) outside of installation or upgrade windows.
Standard user accounts issuing IOCTLs or opening handles to VirtualBox device objects immediately before a privilege change event.

Detection Strategies

Baseline VirtualBox process trees on Windows hosts and alert on deviations, particularly on child processes running as SYSTEM or an administrator.
Monitor Windows Security Event ID 4672 (special privileges assigned) correlated with the parent process being a VirtualBox binary.
Track invocations of VirtualBox command-line tools such as VBoxManage.exe by non-administrative users, especially with arguments that manipulate extension packs, drivers, or shared folders.

Monitoring Recommendations

Inventory all Windows hosts running Oracle VM VirtualBox 7.2.16 and forward endpoint telemetry to a centralized analytics platform.
Enable Windows kernel driver load auditing and forward Sysmon Event ID 6 (driver load) for VirtualBox drivers.
Correlate local logon events (Event ID 4624 type 2 or 10) with subsequent VirtualBox process activity to surface post-authentication abuse.

How to Mitigate CVE-2026-87268

Immediate Actions Required

Identify all Windows systems running Oracle VM VirtualBox 7.2.16 and prioritize them for patching based on user exposure.
Restrict interactive logon on hosts running VirtualBox to trusted administrators until a fixed release is deployed.
Review membership of local groups that grant VirtualBox interaction rights and remove unnecessary users.

Patch Information

Oracle addresses this vulnerability through the Oracle Security Alert referenced as CSPUSEP2026. Administrators should apply the vendor-supplied update for Oracle VM VirtualBox as documented in the Oracle Security Alert CSPUSEP2026. Verify the installed version after patching using VBoxManage.exe --version and confirm the release is later than 7.2.16.

Workarounds

Limit the population of users who can log on locally or via Remote Desktop to Windows hosts running VirtualBox.
Where feasible, migrate VirtualBox workloads to dedicated single-tenant hosts to reduce the pool of potential local attackers.
Disable or uninstall optional VirtualBox components (extension packs, USB support, shared folders) that are not required in production.

bash

# Verify installed VirtualBox version on a Windows host
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" --version

# List local users granted interactive logon rights (PowerShell)
Get-LocalGroupMember -Group "Users"
Get-LocalGroupMember -Group "Remote Desktop Users"