CVE-2026-87267 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle VM VirtualBox deployments, especially those with low-privileged users and RDP access, should assess exposure and prioritize verification of their inventory.

Why it matters

CVE-2026-87267 is a medium-severity vulnerability in Oracle VM VirtualBox that allows low-privileged attackers with network access via RDP to cause a denial of service. Defenders should prioritize verifying exposure, performing inventory checks, and monitoring for unusual activity.

• Potential denial of service (DOS) due to hang or crash of VirtualBox service
• Verification of exposure for VirtualBox services accessible to untrusted networks
• Inventory checks for affected versions and monitoring for unusual activity

Technical summary

The vulnerability in Oracle VM VirtualBox, tracked as CVE-2026-87267, allows low-privileged attackers with network access via RDP to compromise the VirtualBox service, potentially causing a hang or frequently repeatable crash (complete DOS). The CVSS score is 5.3, indicating medium severity. The vulnerability is difficult to exploit and affects version 7.2.16 of Oracle VM VirtualBox in the Core component. Defenders should prioritize verifying exposure of VirtualBox services to untrusted networks and ensuring that only necessary services are accessible.

Defensive priority

Defenders should prioritize verifying exposure of VirtualBox services to untrusted networks and ensuring that only necessary services are accessible. Inventory checks and monitoring for unusual activity are recommended.

Recommended defensive actions

• Verify VirtualBox services exposure to untrusted networks
• Ensure only necessary VirtualBox services are accessible
• Monitor for unusual activity
• Perform inventory checks
• Review compensating controls for exposed systems
• Plan vendor-supported updates or mitigations through normal change control
• Track exceptions and retest remediated assets

Evidence notes

The CVE and NVD records provide details on the vulnerability, its impact, and affected versions. Oracle's security alert page may contain additional information. The vulnerability is difficult to exploit and affects version 7.2.16 of Oracle VM VirtualBox. Defenders should verify exposure, perform inventory checks, and monitor for unusual activity. The CVE record was published on 2026-09-15T20:19:15.370Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. Evidence limits suggest verifying VirtualBox 7.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.