CVE-2026-21986

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-21986 is a vulnerability in the Core component of Oracle VM VirtualBox, which is part of Oracle Virtualization. The supported versions affected are 7.1.14 and 7.2.4. This easily exploitable vulnerability enables an unauthenticated attacker to compromise Oracle VM VirtualBox, resulting in unauthorized ability to cause a hang or frequently repeatable crash, leading to a complete denial of service (DoS). The issue is specific to Windows VMs only, with a CVSS 3.1 base score of 7.1 focused on availability impacts (vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).

An unauthenticated attacker who has logon access to the infrastructure where Oracle VM VirtualBox executes can exploit this vulnerability. While the flaw resides in VirtualBox, exploitation may significantly impact additional products due to a scope change. Successful attacks achieve a complete DoS on VirtualBox through hangs or repeatable crashes, without affecting confidentiality or integrity.

The Oracle Critical Patch Update advisory provides details on mitigation, available at https://www.oracle.com/security-alerts/cpujan2026.html. Security practitioners should consult this reference for patches and recommended actions applicable to the affected versions.