CVE-2026-21987
Published: 20 January 2026
Summary
CVE-2026-21987 is a high-severity an unspecified weakness vulnerability in Oracle Vm Virtualbox. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the core component flaw in affected Oracle VM VirtualBox versions, preventing exploitation by high-privileged local attackers.
Enforces least privilege to deny the high privileges (PR:H) required for local logon attackers to exploit the vulnerability.
Identifies the presence of vulnerable VirtualBox versions through scanning, enabling timely remediation before exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local high-priv exploit with scope change enables privilege escalation to take over VirtualBox and impact other components.
NVD Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise…
more
Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Deeper analysisAI
CVE-2026-21987 is a vulnerability in the Core component of Oracle VM VirtualBox, part of Oracle Virtualization. The supported versions affected are 7.1.14 and 7.2.4. It has a CVSS 3.1 Base Score of 8.2, with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating high impacts to confidentiality, integrity, and availability.
The vulnerability is easily exploitable by a high-privileged attacker (PR:H) who has logon access to the infrastructure where Oracle VM VirtualBox executes (AV:L, AC:L, UI:N). Successful exploitation enables takeover of Oracle VM VirtualBox, and due to the changed scope (S:C), attacks may significantly impact additional products.
The Oracle Critical Patch Update for January 2026 provides details on mitigation and available patches, accessible at https://www.oracle.com/security-alerts/cpujan2026.html.
Details
- CWE(s)