CVE-2026-21990
Published: 20 January 2026
Summary
CVE-2026-21990 is a high-severity an unspecified weakness vulnerability in Oracle Vm Virtualbox. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-21990 is a vulnerability in the Core component of Oracle VM VirtualBox, a product within Oracle Virtualization. The supported versions affected are 7.1.14 and 7.2.4.
The vulnerability is easily exploitable by a high-privileged attacker who has logon access to the infrastructure where Oracle VM VirtualBox executes. Successful exploitation allows the attacker to compromise Oracle VM VirtualBox, resulting in a takeover of the product. Although the flaw resides in Oracle VM VirtualBox, attacks may significantly impact additional products due to a scope change. The CVSS 3.1 base score is 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting high impacts on confidentiality, integrity, and availability.
Oracle's January 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujan2026.html provides further details on this vulnerability, including information on patches and mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3522
Vulnerability details
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise…
more
Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local high-privileged exploit in hypervisor component enabling full product takeover and cross-scope impact, directly matching exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2026-21990 by requiring identification, reporting, and timely patching of the flaw in affected Oracle VM VirtualBox versions.
Reduces the risk of exploitation by ensuring accounts on the host infrastructure where VirtualBox executes do not have unnecessary high privileges (PR:H).
Enables detection of vulnerable VirtualBox installations (7.1.14, 7.2.4) through vulnerability scanning, facilitating proactive remediation.