CVE-2019-2867: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core).

Security readout for executives and security teams

This is a serious Oracle VM VirtualBox flaw. A highly privileged user already logged into the infrastructure running VirtualBox could take over VirtualBox. The sources do not show active exploitation, but the business risk is high where VirtualBox hosts support sensitive workloads or shared environments. Exposure is most likely on systems running Oracle VM VirtualBox versions earlier than 5.2.32 or 6.0.10. Risk depends on whether high-privileged users can log into the host or infrastructure where VirtualBox executes. Prioritize remediation for shared virtualization hosts, developer workstations with sensitive access, and environments where administrators or automation have broad privileges. This is high impact, but urgency is lower than internet-facing unauthenticated issues because exploitation requires high-privileged local access. Mitigation focus: Upgrade VirtualBox to 5.2.32, 6.0.10, or a later vendor-supported release.; Apply Oracle July 2019 CPU guidance where VirtualBox is managed directly.; Apply openSUSE or Gentoo VirtualBox security updates where those distributions manage packages..

Prepared

Jun 6, 2026, 20:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.