---
id: "CVE-2026-87322"
kind: "vulnerability"
aliases: ["CVE-2026-87322"]
title: "Oracle VirtualBox 7.2.20: high-privilege adjacent attacker can take over host"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["developer-workstations", "infrastructure", "self-hosted", "virtualbox"]
not_affected_if: ["no-adjacent-network-access", "not-virtualbox-7.2.20"]
published_at: "2026-10-20T22:20:09+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:01:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87322", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle VirtualBox 7.2.20: high-privilege adjacent attacker can take over host

A flaw in the Core component of Oracle VM VirtualBox 7.2.20 lets a highly privileged attacker on the same network segment compromise the VirtualBox installation. The CVSS vector indicates scope change, so the impact can reach other products on the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `VBoxManage --version` on each host to see whether it reports `7.2.20`.
- Check the installed VirtualBox version in the host's package manager or Oracle's installed-apps list.

## Fix

- Upgrade VirtualBox to the fixed release listed in Oracle's Critical Patch Update advisory for this CVE (version unknown from sources).

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87322

## From the sources

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_