CVE-2026-21988
Published: 20 January 2026
Summary
CVE-2026-21988 is a high-severity an unspecified weakness vulnerability in Oracle Vm Virtualbox. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of flaws in Oracle VM VirtualBox core, directly preventing exploitation of CVE-2026-21988 via patching to unaffected versions.
Vulnerability scanning identifies systems running affected VirtualBox versions 7.1.14 or 7.2.4, enabling targeted remediation.
Enforces least privilege to minimize high-privileged (PR:H) accounts with logon access capable of exploiting this local vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local high-privileged exploitation of VirtualBox core leading to full product takeover with scope change to other components.
NVD Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise…
more
Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Deeper analysisAI
CVE-2026-21988 is a vulnerability in the Core component of Oracle VM VirtualBox, part of Oracle Virtualization. The supported versions affected are 7.1.14 and 7.2.4. It carries a CVSS 3.1 base score of 8.2, with the vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating high impacts to confidentiality, integrity, and availability.
The vulnerability is easily exploitable by a high-privileged attacker (PR:H) who has logon access to the infrastructure where Oracle VM VirtualBox executes (AV:L, AC:L, UI:N). Successful exploitation allows the attacker to compromise Oracle VM VirtualBox, resulting in takeover of the product. Although the flaw resides in Oracle VM VirtualBox, attacks have a changed scope (S:C), potentially significantly impacting additional products.
Mitigation details are available in the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujan2026.html.
Details
- CWE(s)