VM VirtualBox vulnerabilities

67 known vulnerabilities in VM VirtualBox from Oracle. 67 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  Oracle VM VirtualBox: Privilege Defined With Unsafe Actions

  CVE-2025-62587Oct 21, 2025Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Ora

• 7.5 High severity

  Oracle VM VirtualBox: Improper Access Control

  CVE-2025-61760Oct 21, 2025Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Or

• 8.2 High severity

  Oracle VM VirtualBox: Improper Access Control

  CVE-2025-53028Jul 15, 2025Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM Vi

• 8.2 High severity

  Oracle VM VirtualBox: Improper Privilege Management

  CVE-2025-53027Jul 15, 2025Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM Vi

• 8.2 High severity

  Oracle VM VirtualBox: Improper Privilege Management

  CVE-2025-53024Jul 15, 2025Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM Vi

• 8.1 High severity

  Oracle VM VirtualBox: Integer Overflow or Wraparound

  CVE-2025-30712Apr 15, 2025Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.1.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM Vir

• 7.3 High severity

  Oracle VM VirtualBox: Incorrect Permission Assignment for Critical Resource

  CVE-2025-21571Jan 21, 2025Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.24 and prior to 7.1.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infras

• 7.5 High severity

  Oracle VM VirtualBox: Incorrect Authorization

  CVE-2024-21259Oct 15, 2024Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.22 and prior to 7.1.2. Difficult to exploit vulnerability allows high privileged attacker with logon to the infr

• 8.2 High severity

  VM VirtualBox: Improper Privilege Management

  CVE-2024-21141Jul 16, 2024Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.20. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Orac

• 7.8 High severity

  VM VirtualBox: Incorrect Default Permissions

  CVE-2024-21116Apr 16, 2024Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracl

• 8.8 High severity

  VM VirtualBox: Improper Access Control

  CVE-2024-21115Apr 16, 2024Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracl

• 8.8 High severity

  VM VirtualBox: Improper Access Control

  CVE-2024-21114Apr 16, 2024Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracl

• 8.8 High severity

  VM VirtualBox: Improper Access Control

  CVE-2024-21113Apr 16, 2024Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracl

• 8.8 High severity

  VM VirtualBox: Improper Access Control

  CVE-2024-21112Apr 16, 2024Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracl

• 7.8 High severity

  VM VirtualBox: Improper Privilege Management

  CVE-2024-21111Apr 16, 2024OracleEPSS 1.78%

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracl

• 7.3 High severity

  VM VirtualBox: Improper Access Control

  CVE-2024-21110Apr 16, 2024Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracl

• 7.8 High severity

  VM VirtualBox: Improper Access Control

  CVE-2024-21103Apr 16, 2024Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracl

• 8.2 High severity

  VM VirtualBox: Improper Privilege Management

  CVE-2023-22099Oct 17, 2023Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Orac

• 8.2 High severity

  VM VirtualBox: Improper Privilege Management

  CVE-2023-21990Apr 18, 2023Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infras

• 7.8 High severity

  VM VirtualBox: Improper Privilege Management

  CVE-2023-21987Apr 18, 2023Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.44 and Prior to 7.0.8. Difficult to exploit vulnerability allows low privileged attacker with logon to the infra

• 8.1 High severity

  VM VirtualBox: Improper Control of Generation of Code

  CVE-2023-21886Jan 18, 2023OracleEPSS 1.24%

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.42 and prior to 7.0.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access vi

• 8.1 High severity

  VM VirtualBox: Missing Authentication for Critical Functionality

  CVE-2022-39426Oct 18, 2022OracleEPSS 1.37%

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows unauthenticated attacker with network access via VRDP to compromis

• 8.1 High severity

  VM VirtualBox: Missing Authentication for Critical Functionality

  CVE-2022-39425Oct 18, 2022OracleEPSS 2.14%

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows unauthenticated attacker with network access via VRDP to compromis

• 8.1 High severity

  VM VirtualBox: Improper Control of Generation of Code

  CVE-2022-39424Oct 18, 2022OracleEPSS 1.62%

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows unauthenticated attacker with network access via VRDP to compromis

• 7.5 High severity

  VM VirtualBox: Improper Privilege Management

  CVE-2022-39422Oct 18, 2022Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.38. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Or

• 7.3 High severity

  VM VirtualBox: Improper Access Control

  CVE-2022-39421Oct 18, 2022Oracle

  Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracl

• 9.8 Critical severity

  Oracle WebLogic Server, Injection Exploited

  CVE-2019-2725Apr 26, 2019OracleEPSS 100%

  Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network ac