CVE-2026-87285: 
VirtualBox vulnerability analysis and mitigation

CVE-2026-87285 is a denial-of-service vulnerability in the Core component of Oracle VM VirtualBox affecting version 7.2.16. It allows a high-privileged attacker with local logon access to the infrastructure to cause VirtualBox to hang or crash repeatedly, with a scope change that may impact additional products. The vulnerability was disclosed on September 15, 2026, as part of Oracle's Critical Security Patch Update (CSPU). It carries a CVSS v3.1 base score of 6.0 (Medium) (Oracle Advisory, GitHub Advisory).

The vulnerability resides in the Core component of Oracle VM VirtualBox 7.2.16 and is classified as a denial-of-service flaw. No CWE classification has been formally assigned at this time. Exploitation requires an attacker to already have high-privileged (e.g., administrator-level) local access to the host system running VirtualBox; no network access or user interaction is needed. The scope change (S:C) in the CVSS vector indicates that a successful attack can affect resources beyond VirtualBox itself, potentially impacting guest virtual machines or other co-located components. The vulnerability was reported to Oracle by Nebula Security (Oracle Advisory).

Successful exploitation results in a complete denial of service of Oracle VM VirtualBox, manifesting as a hang or frequently repeatable crash of the application. Because the CVSS scope is marked as Changed, the impact may extend beyond VirtualBox to affect additional products or virtual machine guests running on the same infrastructure. There is no confidentiality or integrity impact; the risk is limited to availability (Oracle Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Oracle Advisory). The EPSS score is approximately 0.151%, indicating a low probability of exploitation within the next 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for high-privileged local access, significantly limiting the attacker pool.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update, and customers should apply it immediately. The affected version is Oracle VM VirtualBox 7.2.16; upgrading to a patched release is the recommended remediation. As a temporary measure, organizations should restrict local logon access to the infrastructure running VirtualBox to only trusted, authorized administrators, and monitor VirtualBox processes for unexpected crashes or hangs (Oracle Advisory).