CVE-2026-87282: 
VirtualBox vulnerability analysis and mitigation

CVE-2026-87282 is a denial-of-service vulnerability in the Core component of Oracle VM VirtualBox affecting version 7.2.16. It allows a high-privileged attacker with local logon access to the infrastructure to cause a complete and frequently repeatable hang or crash of the VirtualBox process, with a scope change impacting additional products. The vulnerability was disclosed and patched on September 15, 2026, as part of Oracle's Critical Security Patch Update (CSPU). It carries a CVSS v3.1 base score of 6.0 (Medium) (Oracle Advisory, GitHub Advisory).

The vulnerability resides in the Core component of Oracle VM VirtualBox 7.2.16 and is classified as a local denial-of-service flaw. No CWE classification has been formally assigned at this time. Exploitation requires an attacker to already possess high privileges (e.g., administrator or root) and local logon access to the host system running VirtualBox; no user interaction is needed and attack complexity is low. Despite the vulnerability being local in nature, Oracle notes a scope change, meaning a successful attack can impact components or resources beyond VirtualBox itself (Oracle Advisory, GitHub Advisory). The vulnerability was reported to Oracle by Nebula Security (Oracle Advisory).

Successful exploitation results in a complete denial of service — specifically, the ability to cause Oracle VM VirtualBox to hang or crash in a frequently repeatable manner, disrupting all virtual machines running on the affected host. There is no confidentiality or integrity impact; the attack is purely availability-focused. Because the scope changes, guest virtual machines and potentially other co-hosted workloads may also be disrupted, amplifying the operational impact beyond the VirtualBox process itself (Oracle Advisory, GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.151%, indicating a low probability of exploitation within the next 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for high privileges and local access, significantly limiting the attacker pool.

Oracle has released a patch for this vulnerability as part of the September 15, 2026 Critical Security Patch Update (CSPU); administrators should apply the patch immediately (Oracle Advisory). As a temporary workaround, restrict local logon access to the infrastructure running VirtualBox to only necessary high-privileged users, and implement strict access controls to limit who can authenticate locally on affected systems. Oracle strongly recommends against relying on workarounds as a long-term solution and advises upgrading to a patched version without delay.