CVE-2026-87274: Oracle VM VirtualBox DOS Vulnerability

CVE-2026-87274 Overview

CVE-2026-87274 is a denial of service vulnerability in the Core component of Oracle VM VirtualBox, part of Oracle Virtualization. The affected version is 7.2.16. A low-privileged attacker with local logon access to the host running Oracle VM VirtualBox can exploit this issue, though successful exploitation requires human interaction from a user other than the attacker. The flaw is categorized under [CWE-400] Uncontrolled Resource Consumption. Successful exploitation results in a hang or repeatable crash, producing a complete denial of service of the VirtualBox process. Oracle disclosed the issue in its September 2026 Critical Patch Update.

Critical Impact
Local attackers with valid credentials can trigger a hang or repeatable crash of Oracle VM VirtualBox, causing a complete availability loss for hosted virtual machines.

Affected Products

Oracle VM VirtualBox 7.2.16
Oracle Virtualization (Core component)
Deployments hosting production or development VMs on the affected VirtualBox release

Discovery Timeline

2026-09-15 - CVE-2026-87274 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-87274

Vulnerability Analysis

The vulnerability affects the Core component of Oracle VM VirtualBox 7.2.16. It maps to [CWE-400] Uncontrolled Resource Consumption, which typically involves a code path that fails to bound the resources consumed by an operation. When triggered, VirtualBox enters a state that either hangs indefinitely or crashes reliably, terminating the hypervisor process and its guests.

Oracle classifies exploitation as difficult, requiring a low-privileged local user, user interaction from another party, and specific runtime conditions. Confidentiality and integrity are not affected; the entire impact falls on availability. The EPSS probability sits at 0.11%, reflecting low observed likelihood of exploitation in the wild.

Root Cause

Oracle has not publicly documented the exact root cause. Based on the CWE-400 classification and the Core component scope, the flaw likely resides in a code path that processes attacker-influenced input without adequate resource limits, allowing runaway consumption or a fatal error state inside the VirtualBox process.

Attack Vector

The attack vector is local (AV:L). An authenticated user on the host system triggers the condition, and a separate user must perform an action such as opening a crafted VM, mounting a device, or interacting with a shared resource. Remote exploitation over the network is not possible. Refer to the Oracle Security Alert for advisory details.

No public proof-of-concept exploit is available for CVE-2026-87274 at this time. Technical details are limited to the Oracle Critical Patch Update advisory.

Detection Methods for CVE-2026-87274

Indicators of Compromise

Unexpected termination or hang of the VirtualBox or VBoxHeadless process on affected hosts
Guest virtual machines transitioning to an aborted state without administrator action
Repeated crash dumps or Windows Error Reporting events referencing VirtualBox binaries
Local user sessions executing VirtualBox management actions immediately before a crash

Detection Strategies

Monitor process lifecycle events for VirtualBox binaries and correlate crashes with the invoking user session
Alert on repeated hypervisor process restarts within short time windows on the same host
Review host event logs for kernel or user-mode faults tied to VBoxSVC, VBoxHeadless, or related modules
Track local logon events preceding VirtualBox process termination to identify potential abuse patterns

Monitoring Recommendations

Ingest host telemetry into a centralized platform to correlate VirtualBox crashes across the fleet
Baseline normal VirtualBox process uptime and alert on statistical deviations
Retain crash dumps for forensic analysis to distinguish exploitation from operational faults

How to Mitigate CVE-2026-87274

Immediate Actions Required

Apply the fixes referenced in the Oracle September 2026 Critical Patch Update to all hosts running Oracle VM VirtualBox 7.2.16
Inventory endpoints and servers running VirtualBox to confirm patch coverage
Restrict local logon rights on VirtualBox hosts to trusted administrators only
Educate users on avoiding untrusted VM images or configuration files that require interactive actions

Patch Information

Oracle addresses this vulnerability in the September 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert for the fixed VirtualBox release and upgrade guidance. Update Oracle VM VirtualBox to a version later than 7.2.16 as identified in the advisory.

Workarounds

Limit local interactive access to hosts running Oracle VM VirtualBox until patches are deployed
Avoid importing or executing VirtualBox appliances and configuration files from untrusted sources
Isolate VirtualBox workloads on dedicated hosts to contain the blast radius of a hypervisor crash
Enable automatic restart and monitoring for critical VMs to reduce downtime if the process crashes

bash

# Verify the installed VirtualBox version on Linux hosts
VBoxManage --version

# Restrict interactive logon to administrators (example: Linux PAM access.conf)
# Only allow the vboxadmins group to log in locally
-:ALL EXCEPT vboxadmins:LOCAL