CVE-2026-87301: 
VirtualBox vulnerability analysis and mitigation

CVE-2026-87301 is a local privilege escalation vulnerability in the Core component of Oracle VM VirtualBox, affecting version 7.2.16. It was disclosed on October 20, 2026, as part of Oracle's October 2026 Critical Patch Update (CPU). The vulnerability allows a low-privileged local attacker with logon access to the host infrastructure to compromise VirtualBox, with a scope change that may impact additional products. It carries a CVSS v3.1 base score of 8.4 (High) (Oracle CPU Oct 2026). The vulnerability was reported to Oracle by Tristan Madani of Talence Security (Oracle CPU Oct 2026).

The vulnerability resides in the Core component of Oracle VM VirtualBox and is classified as an Elevation of Privilege issue. It requires only low privileges (local logon access) and no user interaction, and has low attack complexity, making it easily exploitable by any authenticated local user. The changed scope indicates that a successful exploit can affect resources beyond the VirtualBox process itself — potentially impacting the host operating system or other guest VMs. No specific CWE classification or detailed technical write-up has been publicly disclosed at this time (Oracle CPU Oct 2026).

Successful exploitation results in unauthorized access to critical data accessible to Oracle VM VirtualBox processes (high confidentiality impact) and the ability to cause a complete denial of service via hang or repeated crash of VirtualBox (high availability impact). There is no integrity impact noted. The scope change means that beyond VirtualBox itself, additional products or host-level resources may be affected, raising the risk of lateral movement or host compromise in multi-tenant or shared virtualization environments (Oracle CPU Oct 2026).

As of the October 2026 disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Oracle CPU Oct 2026). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low attack complexity and absence of user interaction requirements mean that exploitation is straightforward for any attacker with local logon access to the affected system.

Oracle has released patches for CVE-2026-87301 as part of the October 2026 Critical Patch Update. Affected users should upgrade Oracle VM VirtualBox beyond version 7.2.16 to a patched release (version 7.2.20 or later is listed as addressed in the CPU). Oracle strongly recommends applying the patch as soon as possible. As a temporary risk reduction measure, restricting local logon access to systems running VirtualBox to only authorized and trusted users can reduce exposure, though this is not a permanent fix (Oracle CPU Oct 2026).

The vulnerability was reported by Tristan Madani of Talence Security, who also reported related CVEs CVE-2026-87303 and CVE-2026-87311 in the same Oracle CPU advisory. No significant public researcher commentary, social media discussion, or media coverage specific to CVE-2026-87301 has been identified beyond the Oracle advisory and standard security bulletin aggregators (Oracle CPU Oct 2026).