CVE-2026-21989
BaseFortify
Publication date: 2026-01-20
Last updated on: 2026-01-29
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | vm_virtualbox | 7.1.14 |
| oracle | vm_virtualbox | 7.2.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle VM VirtualBox product, specifically in versions 7.1.14 and 7.2.4. It allows a highly privileged attacker who already has logon access to the infrastructure running Oracle VM VirtualBox to exploit the system. The attacker can compromise Oracle VM VirtualBox, potentially affecting other products as well. The exploitation can lead to unauthorized creation, deletion, or modification of critical data, unauthorized access to all data accessible by Oracle VM VirtualBox, and the ability to cause a partial denial of service (partial DOS) of the product.
How can this vulnerability impact me? :
The impact of this vulnerability includes unauthorized creation, deletion, or modification of critical data within Oracle VM VirtualBox. An attacker could gain unauthorized access to all data accessible by Oracle VM VirtualBox and cause a partial denial of service, affecting availability. This can compromise confidentiality, integrity, and availability of the system and data, potentially disrupting operations and leading to data loss or corruption.