CVE-2026-87277: Oracle VM VirtualBox RDP DOS Vulnerability

CVE-2026-87277 Overview

CVE-2026-87277 is a denial of service vulnerability in the Core component of Oracle VM VirtualBox, part of Oracle Virtualization. The affected version is 7.2.16. An unauthenticated attacker with network access via the Remote Desktop Protocol (RDP) can trigger a hang or repeatable crash of the hypervisor, resulting in complete loss of availability. The flaw is categorized under CWE-400: Uncontrolled Resource Consumption. Oracle addressed the issue in the Oracle Security Alert CSPUSEP2026.

Critical Impact
A remote, unauthenticated attacker can crash Oracle VM VirtualBox instances exposing the built-in RDP service, halting all guest workloads on the affected host.

Affected Products

Oracle VM VirtualBox 7.2.16
Oracle Virtualization (Core component)
Hosts exposing the VirtualBox Remote Display Protocol (VRDP) service

Discovery Timeline

2026-09-15 - CVE-2026-87277 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87277

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle VM VirtualBox, which handles hypervisor operations including the VirtualBox Remote Display Protocol (VRDP) service. A remote attacker can reach the RDP listener without authentication and send input that causes uncontrolled resource consumption inside the VirtualBox process.

The outcome is a hang or a frequently repeatable crash of the hypervisor process. When VirtualBox terminates, every guest virtual machine on that host stops, producing a complete denial of service. Confidentiality and integrity are not affected. Exploitation requires no user interaction and no privileges on the target host.

The underlying weakness maps to [CWE-400: Uncontrolled Resource Consumption]. This class of flaw typically stems from parsing untrusted protocol input without proper bounds, limits, or error handling in a code path reachable before authentication.

Root Cause

The root cause is improper resource management in the Core component when processing network-supplied RDP data. The service accepts attacker-controlled input during protocol negotiation or session handling and fails to constrain the resulting resource use, driving the process into an unrecoverable state.

Attack Vector

Exploitation requires network reachability to the VRDP port exposed by a VirtualBox host, typically TCP 3389 or an operator-configured port. The attacker sends crafted RDP traffic to the listener. No credentials, prior session, or user interaction on the host or guests are required. Successful delivery hangs or crashes the VirtualBox process and terminates all hosted VMs.

No public proof of concept is listed in the enriched data, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list. See the Oracle Security Alert CSPUSEP2026 for vendor technical details.

Detection Methods for CVE-2026-87277

Indicators of Compromise

Unexpected termination or hang of the VBoxHeadless, VirtualBoxVM, or VBoxSVC processes on hosts running VirtualBox 7.2.16.
Sudden simultaneous shutdown of multiple guest VMs on a single host without administrator action.
Inbound RDP connections to VirtualBox hosts from unexpected source addresses in firewall or NetFlow logs.
Crash dumps or hypervisor log entries referencing the VRDP subsystem around the time of the outage.

Detection Strategies

Monitor VirtualBox process lifecycle events and correlate abrupt exits with inbound traffic to the VRDP listener port.
Alert on repeated short-lived RDP connections to VirtualBox hosts, which can indicate crash-and-retry probing.
Baseline expected RDP sources for each VirtualBox host and flag connections from outside that baseline.

Monitoring Recommendations

Collect host process telemetry and network flow logs for all systems running Oracle VM VirtualBox and ship them to a central analytics platform.
Track guest VM availability and correlate mass downtime events with host-level VRDP traffic.
Review VirtualBox host logs (VBox.log, VBoxSVC.log) for VRDP errors or repeated client disconnects.

How to Mitigate CVE-2026-87277

Immediate Actions Required

Inventory all hosts running Oracle VM VirtualBox 7.2.16 and identify which have the VRDP service enabled.
Restrict network access to VRDP ports so that only trusted management networks can reach VirtualBox hosts.
Apply the Oracle fixes referenced in the Oracle Security Alert CSPUSEP2026 as soon as they are validated in your environment.

Patch Information

Oracle addresses this vulnerability through the security alert tracked as CSPUSEP2026. Administrators should upgrade Oracle VM VirtualBox to the fixed version listed by Oracle for the 7.2 branch. Refer to the Oracle Security Alert CSPUSEP2026 for the authoritative patch matrix and download locations.

Workarounds

Disable the VRDP server on VirtualBox VMs that do not require remote console access using VBoxManage modifyvm <vmname> --vrde off.
Bind the VRDP listener to 127.0.0.1 or a management-only interface where remote console is required.
Enforce host-based firewall rules to allow VRDP only from authorized administrator subnets.
Require VPN or bastion access for administrators who need to reach VirtualBox consoles remotely.

bash

# Configuration example
# Disable VRDP for a specific VM
VBoxManage modifyvm "MyVM" --vrde off

# Or restrict VRDP to loopback and a non-default port
VBoxManage modifyvm "MyVM" --vrde on \
  --vrdeaddress 127.0.0.1 \
  --vrdeport 5000

# Host firewall: allow VRDP only from management subnet (Linux nftables example)
nft add rule inet filter input tcp dport 5000 ip saddr 10.10.0.0/24 accept
nft add rule inet filter input tcp dport 5000 drop