Security Resilience

CVE-2026-21990

Oracle Vm Virtualbox 7.1.14 … 7.2.4

Published
20 January 2026
Modified
29 January 2026
Patch / advisory
View advisory
CVSS Score v3.1 8.2
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0021 11th percentile
Risk Priority 53 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-21990 is a high-severity an unspecified weakness vulnerability in Oracle Vm Virtualbox. Its CVSS base score is 8.2 (High).

Operationally, ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-21990 is a vulnerability in the Core component of Oracle VM VirtualBox, a product within Oracle Virtualization. The supported versions affected are 7.1.14 and 7.2.4.

The vulnerability is easily exploitable by a high-privileged attacker who has logon access to the infrastructure where Oracle VM VirtualBox executes. Successful exploitation allows the attacker to compromise Oracle VM VirtualBox, resulting in a takeover of the product. Although the flaw resides in Oracle VM VirtualBox, attacks may significantly impact additional products due to a scope change. The CVSS 3.1 base score is 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting high impacts on confidentiality, integrity, and availability.

Oracle's January 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujan2026.html provides further details on this vulnerability, including information on patches and mitigation.

EU & UK References

Vulnerability Data

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise…

more

Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

CWE(s)
NVD-CWE-noinfo

Related Threats

CVEs Like This One

CVE-2026-71138Same product: Oracle Vm Virtualbox
CVE-2025-30712Same product: Oracle Vm Virtualbox
CVE-2026-35275Same product: Oracle Vm Virtualbox
CVE-2026-87272Same product: Oracle Vm Virtualbox
CVE-2023-21988Same product: Oracle Vm Virtualbox
CVE-2026-46768Same product: Oracle Vm Virtualbox
CVE-2025-61759Same product: Oracle Vm Virtualbox
CVE-2023-22100Same product: Oracle Vm Virtualbox
CVE-2026-71131Same product: Oracle Vm Virtualbox
CVE-2026-60161Same product: Oracle Vm Virtualbox

Affected Assets

oracle
vm virtualbox
7.1.14, 7.2.4

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References