PT-2026-3733 · Oracle+1 · Virtualbox+1

Mohammed Ba Rashed · Published 2026-01-01 · Updated 2026-03-19 · CVE-2026-21986

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions 7.1.14 through 7.2.4

Description An easily exploitable issue exists in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). An unauthenticated attacker with access to the infrastructure where Oracle VM VirtualBox runs can compromise the software. Successful exploitation can lead to a denial-of-service condition, causing Oracle VM VirtualBox to hang or crash repeatedly. This vulnerability affects Windows Virtual Machines only.

Recommendations Update Oracle VM VirtualBox to a version later than 7.2.4. Update Oracle VM VirtualBox to a version later than 7.1.14.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2026-00736

CVE-2026-21986

Affected Products

Virtualbox

Red Os

References · 19

• 🔥 https://github.com/MohaBars/CVE-2026-21986-VirtualBox-DoS · Exploit
• https://osv.dev/vulnerability/CVE-2026-21986 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2026.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-21986 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-21986 · Security Note
• https://bdu.fstec.ru/vul/2026-00736 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-21986 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21986 · Security Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-virtualbox-kmod-cve-2026-21986-8.0 · Note
• https://twitter.com/VulmonFeeds/status/2013787636096241693 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-virtualbox-cve-2026-21986-7.3 · Note
• https://cybersecurity-help.cz/vdb/SB20260120194 · Note
• https://t.me/CVEtracker/42641 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-virtualbox-cve-2026-21986-8.0 · Note
• https://twitter.com/CVEnew/status/2013740396581474764 · Twitter Post