CVE-2026-87311: Oracle VM VirtualBox Core DOS Vulnerability

CVE-2026-87311 Overview

CVE-2026-87311 is a denial of service vulnerability in the Core component of Oracle VM VirtualBox. The flaw affects version 7.2.16 of the Oracle Virtualization product line. A low-privileged attacker with local logon access to the host where Oracle VM VirtualBox executes can trigger a hang or repeatable crash, resulting in complete loss of availability. Although the vulnerability resides within VirtualBox, exploitation can produce a scope change that affects additional products on the host. Oracle disclosed the issue in the October 2026 Critical Patch Update.

Critical Impact
Successful exploitation yields a complete denial of service of the VirtualBox hypervisor, disrupting all guest virtual machines running on the affected host.

Affected Products

Oracle VM VirtualBox 7.2.16
Oracle Virtualization (Core component)
Host systems executing the affected VirtualBox version

Discovery Timeline

2026-10-20 - CVE-2026-87311 published to NVD
2026-10-21 - Last updated in NVD database
October 2026 - Addressed in Oracle Critical Patch Update (Oracle Security Alert October 2026)

Technical Details for CVE-2026-87311

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle VM VirtualBox, which handles hypervisor functions including virtual machine lifecycle management, memory virtualization, and device emulation. An attacker with existing low-privileged access to the host can supply crafted input or trigger a specific execution path that forces the hypervisor into an unrecoverable state. The attack requires local access and has high complexity, meaning the attacker must satisfy preconditions outside their direct control to succeed.

Exploitation produces a scope change under the CVSS model. This indicates that the impact extends beyond the vulnerable VirtualBox process to other components or guest workloads on the same host. Because the Core component underpins all virtualized operations, a crash halts every running guest VM and may disrupt dependent services on the host.

Root Cause

Oracle has not published root cause details. The advisory classifies the issue as a Denial of Service condition affecting availability only, with no impact to confidentiality or integrity. The scope change indicates the defect involves a shared or privileged resource managed by the hypervisor rather than a self-contained process boundary.

Attack Vector

The attack vector is local. An attacker must authenticate to the host operating system with low privileges before attempting exploitation. No user interaction from an administrator or other party is required. Remote network exploitation is not possible. The high attack complexity requirement limits opportunistic exploitation, but a motivated attacker with persistent host access can repeat the trigger reliably once conditions are met.

No public proof-of-concept exploit code is available for this issue, and the EPSS probability remains low. Refer to the Oracle Security Alert October 2026 for vendor technical context.

Detection Methods for CVE-2026-87311

Indicators of Compromise

Unexpected termination or hang of the VBoxHeadless, VirtualBoxVM, or VBoxSVC processes on the host.
Repeated hypervisor crash dumps or kernel log entries referencing VirtualBox kernel modules such as vboxdrv.
Guest virtual machines entering an aborted state without administrator action.

Detection Strategies

Monitor host operating system event logs and syslog for recurring VirtualBox process crashes correlated with specific local user sessions.
Alert on virtual machine state transitions from Running to Aborted that occur in clusters or affect multiple guests simultaneously.
Baseline normal hypervisor behavior and flag anomalous increases in low-privileged user activity preceding VirtualBox instability.

Monitoring Recommendations

Collect host telemetry including process termination events, kernel ring buffer messages, and VirtualBox service logs into a centralized SIEM.
Track local logon activity on hosts running VirtualBox and correlate it with hypervisor availability metrics.
Enable crash dump collection on VirtualBox hosts to support post-incident analysis if exploitation is suspected.

How to Mitigate CVE-2026-87311

Immediate Actions Required

Apply the Oracle October 2026 Critical Patch Update to all systems running Oracle VM VirtualBox 7.2.16.
Inventory hosts running affected VirtualBox versions and prioritize patching for systems hosting production or multi-tenant workloads.
Restrict interactive logon rights on VirtualBox hosts to administrators and trusted service accounts only.

Patch Information

Oracle addressed CVE-2026-87311 in the October 2026 Critical Patch Update. Administrators should download the updated VirtualBox release from Oracle and follow the upgrade guidance published in the Oracle Security Alert October 2026. Verify installed versions after upgrade using VBoxManage --version on each host.

Workarounds

Enforce least privilege on VirtualBox host systems to reduce the pool of users capable of attempting local exploitation.
Separate VirtualBox hosts from general-purpose multi-user systems where feasible, limiting local shell access to administrators.
Implement host-based monitoring to detect repeated hypervisor crashes and trigger investigation workflows promptly.

bash

# Verify installed VirtualBox version after patching
VBoxManage --version

# List local users with interactive logon capability on Linux hosts
getent passwd | awk -F: '$7 !~ /nologin|false/ {print $1}'