CVE-2026-21957
Published: 20 January 2026
Summary
CVE-2026-21957 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Oracle Vm Virtualbox. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 11.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-21957 is a vulnerability in the Core component of the Oracle VM VirtualBox product within Oracle Virtualization. The supported versions affected are 7.1.14 and 7.2.4. It is classified under CWE-269 and has a CVSS 3.1 Base Score of 7.5, with the vector (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating high impacts to confidentiality, integrity, and availability.
A high privileged attacker (PR:H) with logon access (AV:L) to the infrastructure where Oracle VM VirtualBox executes can exploit this difficult-to-exploit vulnerability (AC:H), requiring no user interaction (UI:N). While the flaw resides in VirtualBox, exploitation changes scope (S:C) and may significantly impact additional products. Successful attacks result in takeover of Oracle VM VirtualBox.
Oracle's security alert at https://www.oracle.com/security-alerts/cpujan2026.html provides details on mitigation, including available patches for the affected versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3554
Vulnerability details
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to…
more
compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-269 improper privilege management in VirtualBox core enables local high-priv escalation to full hypervisor takeover with scope change.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2026-21957 by requiring timely remediation through application of Oracle-provided patches for affected VirtualBox versions.
Limits the attack surface by restricting high-privileged (PR:H) accounts with logon access (AV:L) needed to exploit the vulnerability in VirtualBox.
Enables identification of vulnerable VirtualBox instances through vulnerability scanning, facilitating timely patching before exploitation.