CVE-2026-87303 Oracle Corporation CVE debrief

Who should care

Defenders and administrators responsible for Oracle VM VirtualBox installations, especially in environments with low-privileged user access, should assess exposure and prioritize patching.

Why it matters

CVE-2026-87303 is a medium-severity vulnerability in Oracle VM VirtualBox that allows low-privileged attackers to cause a denial of service. Defenders should prioritize patching and verifying VirtualBox installations, especially in environments with low-privileged user access.

• Potential denial of service (DOS) impacting availability
• Possible scope change impacting additional products
• Requires verification of user interaction and access controls
• Needs patching and configuration review for VirtualBox infrastructure

Technical summary

The vulnerability in Oracle VM VirtualBox has a CVSS 3.1 Base Score of 5.9 (Availability impacts). It allows low-privileged attackers with logon access to compromise the system, potentially impacting additional products. Successful attacks require human interaction and can result in a complete denial of service (DOS). The vulnerability affects Oracle VM VirtualBox version 7.2.16 and has a CVSS Vector of (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H). Defenders should prioritize verifying and patching Oracle VM VirtualBox installations, especially in environments with low-privileged user access.

Defensive priority

Defenders should prioritize verifying and patching Oracle VM VirtualBox installations, especially in environments with low-privileged user access.

Recommended defensive actions

• Verify and apply Oracle VM VirtualBox patches
• Restrict logon access to VirtualBox infrastructure
• Monitor for suspicious user interactions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its CVSS score, and potential impacts. Oracle's security alert documentation is also available for reference. The vulnerability affects Oracle VM VirtualBox version 7.2.16 and has a CVSS Vector of (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.