CVE-2026-87284: 
VirtualBox vulnerability analysis and mitigation

CVE-2026-87284 is a denial-of-service vulnerability in the Core component of Oracle VM VirtualBox, affecting version 7.2.16. It was disclosed on September 15, 2026, as part of Oracle's Critical Security Patch Update (CSPU) for September 2026. The vulnerability allows a high-privileged local attacker to cause a partial denial of service of the VirtualBox service, with a scope change indicating potential impact on additional products. It carries a CVSS v3.1 base score of 3.2 (Low severity) (Oracle Advisory, GitHub Advisory). The vulnerability was reported to Oracle by Nebula Security (Oracle Advisory).

The vulnerability resides in the Core component of Oracle VM VirtualBox 7.2.16 and requires local access with high privileges (e.g., administrative logon to the host infrastructure) to exploit. No CWE classification has been formally assigned at this time. The attack vector is local (AV:L), attack complexity is low (AC:L), and no user interaction is required, making it straightforward to trigger for an attacker who already has elevated access. The scope change (S:C) in the CVSS vector indicates that a successful attack can affect resources beyond the VirtualBox component itself, though the availability impact is limited (A:L) and there is no confidentiality or integrity impact (Oracle Advisory, GitHub Advisory).

Successful exploitation results in a partial denial of service of Oracle VM VirtualBox, degrading availability of the virtualization service without exposing confidential data or allowing unauthorized modification of data. The scope change in the CVSS rating suggests that the disruption may extend beyond VirtualBox itself to other products or components running on the same infrastructure. Given the requirement for high privileges and local access, the practical blast radius is limited, and there is no evidence of data exfiltration or lateral movement risk associated with this vulnerability (Oracle Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.148% (4th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high-privilege local access, significantly limiting the attacker pool.

Oracle has released a patch for this vulnerability as part of the September 2026 Critical Security Patch Update; administrators should apply the available security patch to Oracle VM VirtualBox 7.2.16 as soon as possible (Oracle Advisory). As an interim measure, Oracle recommends restricting logon access to the infrastructure where VirtualBox executes to authorized administrative users only, and monitoring for suspicious administrative activity on affected systems. Oracle strongly advises against relying on workarounds as a long-term solution, as they do not address the underlying vulnerability.

The vulnerability was reported to Oracle by Nebula Security, which also reported several related CVEs (CVE-2026-87280 through CVE-2026-87285) in the same advisory cycle (Oracle Advisory). No notable public researcher commentary, social media discussion, or significant media coverage specific to this low-severity CVE has been observed.