PT-2026-3705 · Oracle · Virtualbox

Nini + 1 · Published 2026-01-01 · Updated 2026-02-16 · CVE-2026-21957

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

7.5

High

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions 7.1.14 through 7.2.4

Description The issue resides in the Core component of Oracle VM VirtualBox and is due to insufficient input validation. Exploitation may allow an attacker to gain full control over the application and potentially compromise Oracle VM VirtualBox. Successful attacks can result in a takeover of Oracle VM VirtualBox, and may significantly impact additional products. The vulnerability is difficult to exploit and requires a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox is running. The vulnerability can be leveraged to achieve AAR/AAW and facilitate VM escape.

Recommendations Oracle VM VirtualBox version 7.1.14 should be updated. Oracle VM VirtualBox version 7.2.4 should be updated.

Fix

RCE

Improper Privilege Management

Weakness Enumeration

CWE-20

CWE-269

Related Identifiers

BDU:2026-00723

CVE-2026-21957

ZDI-26-102

Affected Products

Virtualbox

References · 11

• https://zerodayinitiative.com/advisories/ZDI-26-102 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-21957 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-21957 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-21957 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2026.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00723 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-21957 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21957 · Note
• https://twitter.com/terrynini38514/status/2023442277709082763 · Twitter Post
• https://twitter.com/CVEnew/status/2013783002061644149 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB20260120194 · Note