PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-71113 Oracle Corporation CVE debrief

The CVE-2026-71113 vulnerability affects Oracle VM VirtualBox product of Oracle Virtualization (component: Core) version 7.2.14. This is an easily exploitable vulnerability that allows unauthenticated attackers with network access via RDP to compromise Oracle VM VirtualBox, potentially leading to a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. System administrators and security teams should prioritize applying vendor remediation to prevent potential DOS attacks. The CVSS 3.1 Base Score is 7.5 (Availability impacts).

Vendor
Oracle Corporation
Product
Oracle VM VirtualBox
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-18
Original CVE updated
2026-08-26
Advisory published
2026-08-18
Advisory updated
2026-08-26

Who should care

System administrators and security teams responsible for Oracle VM VirtualBox installations, particularly those with version 7.2.14, should prioritize applying vendor remediation to prevent potential DOS attacks. Additionally, operators and platforms using Oracle VM VirtualBox should review their vulnerability management and security teams to ensure they are prepared to address this vulnerability.

Technical summary

The vulnerability in Oracle VM VirtualBox product of Oracle Virtualization (component: Core) version 7.2.14 allows unauthenticated attackers with network access via RDP to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. The CVSS 3.1 Base Score is 7.5 (Availability impacts).

Defensive priority

High priority due to high CVSS score of 7.5 and potential for complete DOS of Oracle VM VirtualBox.

Recommended defensive actions

  • Inventory and verify Oracle VM VirtualBox version 7.2.14
  • Apply vendor remediation as described in Oracle's security alert
  • Monitor for unauthorized access via RDP
  • Implement compensating controls to limit network access
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

Evidence from official CVE Program record and NIST NVD detail page indicates a vulnerability in Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via RDP to compromise Oracle VM VirtualBox.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-71113 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-71113

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-71113 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-71113

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.