CVE-2026-87275: Oracle VM VirtualBox Information Disclosure

CVE-2026-87275 Overview

CVE-2026-87275 is a local access control vulnerability in the Core component of Oracle VM VirtualBox. The flaw affects supported version 7.2.16 of Oracle Virtualization. A high-privileged attacker with local logon access to the infrastructure running VirtualBox can exploit this weakness to compromise the hypervisor.

Successful exploitation results in unauthorized read access to a subset of VirtualBox data and the ability to cause a partial denial of service. The vulnerability carries a scope change, meaning impact can extend beyond VirtualBox to other products on the host.

Critical Impact
Local attackers with elevated privileges can read sensitive VirtualBox data and trigger partial denial-of-service conditions, with cross-boundary impact to additional host products.

Affected Products

Oracle VM VirtualBox version 7.2.16
Oracle Virtualization (Core component)
Host systems running the affected VirtualBox release

Discovery Timeline

2026-09-15 - CVE-2026-87275 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-87275

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle VM VirtualBox and is categorized under [CWE-284] Improper Access Control. Oracle classifies the flaw as easily exploitable, requiring only local logon access to the host infrastructure where VirtualBox executes.

The attack requires high privileges on the host but no user interaction. The scope change property indicates that successful exploitation can affect resources beyond the vulnerable component, extending impact to other software running on the same host. Confidentiality and availability are both affected, while integrity remains intact.

Exploitation yields two outcomes: partial disclosure of VirtualBox-accessible data and a partial denial of service of the VirtualBox service. The Exploit Prediction Scoring System (EPSS) currently rates in-the-wild exploitation probability as low.

Root Cause

The root cause is improper enforcement of access control boundaries within the VirtualBox Core component. The Core subsystem handles hypervisor operations including virtual machine lifecycle, device emulation, and inter-process communication with host services. Missing or incorrect authorization checks allow a privileged local principal to reach data or code paths that should remain isolated from that principal's scope.

Attack Vector

Exploitation requires local access to the host and pre-existing high privileges on the infrastructure hosting VirtualBox. An attacker with such access can invoke the vulnerable Core interfaces to read data outside their intended access scope and disrupt VirtualBox availability. Remote or network-based exploitation is not possible. See the Oracle Security Alert CSPUSEP2026 for vendor technical details.

No public proof-of-concept exploit or exploit code is currently available for CVE-2026-87275.

Detection Methods for CVE-2026-87275

Indicators of Compromise

Unexpected VirtualBox service crashes, hangs, or restarts on hosts running version 7.2.16
Anomalous access patterns from privileged local accounts to VirtualBox process memory, configuration files, or IPC endpoints
Unauthorized reads of VirtualBox VM configuration files (.vbox, .vbox-prev) or virtual disk metadata by non-owner accounts

Detection Strategies

Monitor for privileged local process activity interacting with VBoxSVC, VBoxHeadless, and related VirtualBox binaries
Audit host operating system logs for privilege elevation events preceding VirtualBox API calls
Correlate VirtualBox log files (VBox.log) with host authentication events to identify unauthorized session activity

Monitoring Recommendations

Enable operating system auditing on VirtualBox installation directories and per-user VirtualBox VMs folders
Alert on repeated VirtualBox process termination or restart events across managed hosts
Track configuration and permission changes to VirtualBox binaries, drivers, and kernel modules

How to Mitigate CVE-2026-87275

Immediate Actions Required

Inventory all hosts running Oracle VM VirtualBox 7.2.16 and prioritize patching for systems with multiple privileged local users
Apply the fix referenced in the Oracle Security Alert CSPUSEP2026 as soon as it is available in your environment
Restrict local host logon rights to the minimum set of administrators required to operate the virtualization infrastructure

Patch Information

Oracle addresses this vulnerability in the security update referenced by the Oracle Security Alert CSPUSEP2026. Administrators should consult the advisory for the specific patched version and apply it to all affected VirtualBox 7.2.16 installations. Confirm patch application by verifying the running VirtualBox version after update.

Workarounds

Limit high-privilege accounts on hosts running VirtualBox and enforce separation of duties between virtualization operators and other host administrators
Isolate virtualization hosts from general-purpose workloads to reduce the pool of local principals capable of exploitation
Enable host-based auditing and alerting for privileged process activity against VirtualBox components until the patch is deployed

bash

# Verify installed VirtualBox version on the host
VBoxManage --version

# List local accounts with elevated privileges (Linux example)
getent group vboxusers wheel sudo

# Review recent privileged sessions (Linux)
last -a | head -n 20