{"id":"CVE-2026-87322","kind":"vulnerability","aliases":["CVE-2026-87322"],"related":[],"title":"Oracle VirtualBox 7.2.20: high-privilege adjacent attacker can take over host","description":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).","summary":"A flaw in the Core component of Oracle VM VirtualBox 7.2.20 lets a highly privileged attacker on the same network segment compromise the VirtualBox installation. The CVSS vector indicates scope change, so the impact can reach other products on the host.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-workstations","infrastructure","self-hosted","virtualbox"],"not_affected_if":["no-adjacent-network-access","not-virtualbox-7.2.20"],"how_to_check":"- Run `VBoxManage --version` on each host to see whether it reports `7.2.20`.\n- Check the installed VirtualBox version in the host's package manager or Oracle's installed-apps list.","fix":"- Upgrade VirtualBox to the fixed release listed in Oracle's Critical Patch Update advisory for this CVE (version unknown from sources).","status":"open","published_at":"2026-10-20T22:20:09+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:01:49+00:00","updated_at":"2026-10-25T03:01:49+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:01:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade VirtualBox to the fixed release listed in Oracle's Critical Patch Update advisory for this CVE (version unknown from sources).","reach":"network","title":"Oracle VirtualBox 7.2.20: high-privilege adjacent attacker can take over host","impact":"high","summary":"A flaw in the Core component of Oracle VM VirtualBox 7.2.20 lets a highly privileged attacker on the same network segment compromise the VirtualBox installation. The CVSS vector indicates scope change, so the impact can reach other products on the host.","category":"infrastructure","nicknames":[],"who_cares":["virtualbox","self-hosted","developer-workstations"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over VirtualBox and may affect other host products.","analyst_note":"Find the fixed VirtualBox version and affected range in Oracle's July CPU advisory; the sources only name 7.2.20.","how_to_check":"- Run `VBoxManage --version` on each host to see whether it reports `7.2.20`.\n- Check the installed VirtualBox version in the host's package manager or Oracle's installed-apps list.","needs_analyst":true,"not_affected_if":["not-virtualbox-7.2.20","no-adjacent-network-access"],"who_is_affected":"Hosts running Oracle VM VirtualBox 7.2.20 are affected, most of all those reachable from a shared network segment with attackers who already hold high privileges. Teams that do not run VirtualBox, or run a different version, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000643,"input_tokens":3508,"output_tokens":584,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-87322':15A,18A '/av':160C '3.1':147C,159C '7.2.20':3A,37B,87C '8.4':150C 'a/ac':161C 'access':96C 'addit':129C 'adjac':7A 'affect':85C 'allow':91C 'attach':102C 'attack':8A,42B,94C,125C,134C 'avail':154C 'base':148C 'c/c':165C 'chang':57B,132C 'communic':100C 'compon':32B,78C 'compromis':48B,113C 'confidenti':151C 'core':31B,79C 'cve':13A,16A 'cvss':53B,146C,156C,158C 'develop':20B 'developer-workst':19B 'easili':88C 'execut':111C 'exploit':89C 'flaw':28B 'h':168C 'h/a':167C 'h/i':166C 'h/ui':163C 'hardwar':105C 'high':5A,40B,92C 'high-privileg':4A 'host':12A,25B,67B 'impact':60B,128C,155C 'indic':55B 'infrastructur':22B 'instal':51B 'integr':152C 'l/pr':162C 'let':38B 'may':126C 'n/s':164C 'network':46B 'oracl':1A,34B,71C,76C,108C,114C,122C,143C 'physic':99C 'privileg':6A,41B,93C 'product':64B,74C,130C 'reach':62B 'result':139C 'scope':56B,131C 'score':149C 'segment':47B,101C 'self':24B 'self-host':23B 'signific':127C 'success':133C 'support':81C 'take':10A 'takeov':141C 'vector':54B,157C 'version':82C 'virtual':77C 'virtualbox':2A,26B,36B,50B,73C,110C,116C,124C,145C 'vm':35B,72C,109C,115C,123C,144C 'vulner':68C,90C,119C,137C 'workstat':21B","nicknames":[],"mitigations":[],"who_affected":"Hosts running Oracle VM VirtualBox 7.2.20 are affected, most of all those reachable from a shared network segment with attackers who already hold high privileges. Teams that do not run VirtualBox, or run a different version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87322","severity":null,"published_at":"2026-10-20T22:20:09+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}