CVE-2026-87281: 
VirtualBox vulnerability analysis and mitigation

CVE-2026-87281 is a memory disclosure vulnerability in the Core component of Oracle VM VirtualBox, affecting version 7.2.16. It allows a high-privileged local attacker to gain unauthorized read access to a subset of VirtualBox-accessible data, with a scope change that may impact additional products beyond VirtualBox itself. The vulnerability was disclosed and patched on September 15, 2026, as part of Oracle's Critical Security Patch Update (CSPU). It carries a CVSS v3.1 base score of 3.2 (Low) (Oracle Advisory, Github Advisory).

The vulnerability resides in the Core component of Oracle VM VirtualBox and is classified as a memory disclosure issue (attack type: Memory Disclosure). Exploitation requires local logon access to the infrastructure where VirtualBox executes, with high privileges (e.g., administrator or root-level access), and no user interaction. The scope change (S:C) in the CVSS vector indicates that a successful attack can affect resources beyond the VirtualBox security boundary, potentially exposing data from guest or host contexts. No specific CWE classification has been assigned by Oracle or NVD at this time. The vulnerability was reported to Oracle by Nebula Security (Oracle Advisory).

Successful exploitation results in unauthorized read access to a subset of Oracle VM VirtualBox accessible data, impacting confidentiality only — there is no impact to integrity or availability. The scope change means that data from components beyond VirtualBox itself (e.g., guest VMs or host resources accessible to VirtualBox) could potentially be exposed. The overall risk is limited due to the requirement for high privileges and local access, making mass exploitation unlikely (Oracle Advisory, Github Advisory).

There is no public proof-of-concept (PoC) exploit available, and no evidence of in-the-wild exploitation has been observed (Feedly). The EPSS score is approximately 0.154%, indicating a very low probability of exploitation within the next 30 days (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update (CSPU), targeting Oracle VM VirtualBox version 7.2.16. Administrators should apply the patch immediately by following Oracle's patch availability documentation. As interim mitigations, restrict local logon access to systems running VirtualBox to trusted administrators only, and limit user privileges to the minimum required. Monitor access logs for unauthorized local access attempts (Oracle Advisory).