CVE-2026-21983
Published: 20 January 2026
Summary
CVE-2026-21983 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Oracle Vm Virtualbox. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 11.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-21983 is a vulnerability in the Core component of Oracle VM VirtualBox, a product within Oracle Virtualization. The supported versions affected are 7.1.14 and 7.2.4. It is classified under CWE-269 and has a CVSS 3.1 base score of 7.5, with the vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating high impacts to confidentiality, integrity, and availability.
The vulnerability is difficult to exploit and requires a high-privileged attacker (PR:H) with local logon access (AV:L) to the infrastructure hosting Oracle VM VirtualBox, along with high attack complexity (AC:H) and no user interaction (UI:N). Successful exploitation enables compromise and takeover of Oracle VM VirtualBox. Although the flaw resides in VirtualBox, the changed scope (S:C) means attacks may significantly impact additional products.
Oracle has issued a security alert in its Critical Patch Update for January 2026, available at https://www.oracle.com/security-alerts/cpujan2026.html, which provides details on mitigation and patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3529
Vulnerability details
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to…
more
compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-269 improper privilege management in VirtualBox core with local high-priv access enables host-side exploitation for privilege escalation and hypervisor takeover (scope change).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2026-21983 by requiring timely patching of the vulnerable VirtualBox core component as provided in Oracle's Critical Patch Update.
Enforces least privilege to counter the PR:H requirement and CWE-269 improper privilege management, limiting high-privileged local attackers' ability to exploit the vulnerability.
Enforces access control policies to restrict logical access to VirtualBox resources, reducing the risk of takeover despite local logon access.