CVE-2026-87278: Oracle VM VirtualBox DOS Vulnerability

CVE-2026-87278 Overview

CVE-2026-87278 is a local vulnerability in the Core component of Oracle VM VirtualBox, part of Oracle Virtualization. The affected supported version is 7.2.16. An unauthenticated attacker with logon access to the infrastructure where Oracle VM VirtualBox executes can exploit the flaw, but successful attacks require interaction from a user other than the attacker. Exploitation can cause a hang or repeatable crash resulting in a complete denial of service (DoS) of Oracle VM VirtualBox. Attackers can also gain unauthorized update, insert, or delete access to a subset of VirtualBox-accessible data. The weakness is categorized under [CWE-284: Improper Access Control].

Critical Impact
Successful exploitation crashes Oracle VM VirtualBox and allows unauthorized modification of some accessible data, disrupting virtualized workloads on the host.

Affected Products

Oracle VM VirtualBox 7.2.16 (Core component)
Oracle Virtualization product family
Deployments where users may interact with attacker-supplied VM content on the host

Discovery Timeline

2026-09-15 - CVE-2026-87278 published to NVD
2026-09-17 - Last updated in NVD database
Vendor advisory published as part of the Oracle Security Alert

Technical Details for CVE-2026-87278

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle VM VirtualBox 7.2.16. It stems from improper access control ([CWE-284]) that permits an unprivileged local actor to influence VirtualBox operations that should be restricted. Exploitation requires local logon to the host running VirtualBox and user interaction from a separate victim, such as opening or importing a malicious virtual machine artifact. When triggered, the flaw causes a repeatable crash or hang of the hypervisor process, halting all running guests. In addition to availability loss, the issue enables unauthorized write, update, or delete operations on a limited set of data accessible to VirtualBox.

Root Cause

According to Oracle's advisory, the defect is an improper access control condition inside the VirtualBox Core. Trust boundaries between local users and VirtualBox-managed resources are not correctly enforced, allowing operations that should require higher privileges. Oracle has not published deeper technical detail beyond the Oracle Security Alert.

Attack Vector

The attack vector is local. An attacker must already have logon access to the host running Oracle VM VirtualBox. The attacker then stages content, such as a crafted virtual machine configuration, disk image, or shared resource, that a second user opens or processes through VirtualBox. Once the victim interacts with the malicious content, VirtualBox performs the privileged action on the attacker's behalf, resulting in a crash and limited data tampering. No network access and no prior authentication to VirtualBox itself is required.

No public proof-of-concept code is available. Refer to the Oracle Security Alert for vendor-supplied technical detail.

Detection Methods for CVE-2026-87278

Indicators of Compromise

Repeated or unexplained crashes of the VirtualBox, VBoxSVC, or VBoxHeadless processes on hosts running version 7.2.16.
Unexpected modification, creation, or deletion of VirtualBox configuration files, .vbox metadata, or VM disk images by non-owner local users.
VirtualBox log entries (VBox.log) showing abnormal termination shortly after a user opened an externally supplied VM or appliance.

Detection Strategies

Baseline normal VirtualBox process lifetimes and alert on abnormal exit codes or repeated restarts on the same host.
Monitor local filesystem activity against VirtualBox configuration directories for writes performed by user accounts other than the VM owner.
Correlate user logon events with subsequent VirtualBox crashes to identify sequences consistent with local staging followed by victim interaction.

Monitoring Recommendations

Forward host process, file integrity, and application crash telemetry to a central analytics platform for correlation across the VirtualBox fleet.
Track imports of external appliances (.ova, .ovf) and flag imports originating from untrusted paths or shared user directories.
Alert on any privileged VirtualBox operations invoked by accounts that do not normally administer virtualization on that host.

How to Mitigate CVE-2026-87278

Immediate Actions Required

Inventory all hosts running Oracle VM VirtualBox 7.2.16 and prioritize them for patching per the Oracle Security Alert.
Restrict interactive logon on VirtualBox hosts to trusted administrators and remove shared local accounts.
Instruct users not to open, import, or double-click VirtualBox VMs or appliances received from untrusted sources.

Patch Information

Oracle addressed CVE-2026-87278 in the September 2026 Critical Patch Update / Security Alert cycle. Apply the fixed VirtualBox release referenced in the Oracle Security Alert to affected hosts running version 7.2.16. There are no vendor-approved code changes that substitute for the patch.

Workarounds

Limit local logon rights on VirtualBox hosts to reduce the pool of potential attackers.
Store VM files on per-user directories with strict permissions so other local users cannot stage malicious artifacts.
Disable auto-open or shell integrations for VirtualBox file types on multi-user systems until the patch is deployed.

bash

# Example: restrict permissions on VirtualBox VM directory (Linux host)
chown -R vboxuser:vboxuser /home/vboxuser/VirtualBox\ VMs
chmod -R go-rwx /home/vboxuser/VirtualBox\ VMs

# Verify installed VirtualBox version before and after patching
VBoxManage --version