PT-2026-3710 · Oracle+1 · Virtualbox+1

CVE-2026-21963 · Publicado 2026-01-01 · Atualizado 2026-03-19

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Média

Vetor base

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions 7.1.14 and 7.2.4

Description An easily exploitable issue exists in the Oracle VM VirtualBox Core component, potentially allowing a high-privileged attacker with access to the system where Oracle VM VirtualBox runs to compromise the software. Successful exploitation could lead to unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. Attacks may significantly impact additional products.

Recommendations Versions prior to 7.1.14 and 7.2.4 should be updated.

Correção

RCE

Improper Privilege Management

Enumeração de Fraquezas

CWE-20

CWE-269

Identificadores relacionados

BDU:2026-00722

CVE-2026-21963

ZDI-26-101

Produtos afetados

Virtualbox

Red Os

Referências · 17

• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-virtualbox-guest-additions-cve-2026-21963-7.3 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21963 · Nota
• https://zerodayinitiative.com/advisories/ZDI-26-101 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-00722 · Nota de Segurança
• https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2026-21963 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-virtualbox-cve-2026-21963-8.0 · Nota
• https://cybersecurity-help.cz/vdb/SB20260120194 · Nota
• https://oracle.com/security-alerts/cpujan2026.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-21963 · Nota de Segurança
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-virtualbox-cve-2026-21963-7.3 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-virtualbox-kmod-cve-2026-21963-8.0 · Nota
• https://cve.org/CVERecord?id=CVE-2026-21963 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-21963 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-21963 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-virtualbox-guest-additions-cve-2026-21963-8.0 · Nota