CVE-2026-87283: 
VirtualBox vulnerability analysis and mitigation

CVE-2026-87283 is a Denial of Service vulnerability in the Core component of Oracle VM VirtualBox, affecting version 7.2.16. It was disclosed on September 15, 2026, as part of Oracle's Critical Security Patch Update (CSPU) for September 2026. The vulnerability allows a high-privileged local attacker to cause a hang or frequently repeatable crash of the VirtualBox process, with a scope change that may impact additional products. It carries a CVSS v3.1 base score of 6.0 (Medium) (Oracle Advisory, Github Advisory). The vulnerability was reported to Oracle by Nebula Security (Oracle Advisory).

The vulnerability resides in the Core component of Oracle VM VirtualBox version 7.2.16. Exploitation requires local access to the infrastructure where VirtualBox executes, with high privileges (e.g., administrator or root-level access on the host). The attack complexity is low and no user interaction is required, but the attacker must already have elevated local access. No CWE classification has been formally assigned to this vulnerability. The scope change (S:C) in the CVSS vector indicates that a successful attack can affect resources beyond the VirtualBox process itself, potentially impacting guest virtual machines or other host components (Oracle Advisory, Github Advisory).

Successful exploitation results in a complete Denial of Service (DoS) of Oracle VM VirtualBox — specifically, the ability to cause a hang or frequently repeatable crash of the virtualization process. There is no confidentiality or integrity impact. However, due to the scope change, the disruption may extend beyond VirtualBox itself to affect guest virtual machines or other dependent components running on the same infrastructure (Oracle Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is approximately 0.118% (2nd percentile), indicating a low probability of exploitation in the near term (Github Advisory). The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for high-privileged local access, significantly limiting the attacker pool.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Organizations running Oracle VM VirtualBox version 7.2.16 should apply the available patch immediately (Oracle Advisory). As an interim measure, restrict local logon access to the infrastructure where VirtualBox runs to only trusted, high-privileged users. Monitor VirtualBox processes for unexpected crashes or hangs as a detection measure until patching is complete.