Security readout for executives and security teams
Plain-English summary
CVE-2021-35545 affects Oracle VM VirtualBox before 6.1.28. It is not described as remotely exploitable; the attacker needs local/logon access and high privileges. Business impact is mainly disruption of VirtualBox through hangs or repeatable crashes, plus limited unauthorized data reads from data VirtualBox can access.
Executive priority
Treat this as a moderate operational resilience issue. Prioritize patching where VirtualBox supports production, engineering, security testing, or CI workflows. Urgency is lower than remotely exploitable flaws, but disruption and limited data exposure are credible if privileged local access exists.
Technical view
The issue is in the VirtualBox Core component before 6.1.28. CVSS v3.1 is 6.7: AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H. Successful exploitation can cause complete denial of service and limited confidentiality impact. Oracle notes attacks may significantly impact additional products.
Likely exposure
Likely exposure is systems running Oracle VM VirtualBox earlier than 6.1.28, especially developer workstations, lab hosts, CI hosts, or virtualization infrastructure where privileged local users can log on. The provided vector indicates local access, not direct internet exposure.
Exploitation context
The provided bundle does not show CISA KEV listing or active exploitation evidence. Exploitation is characterized as easy once an attacker already has high privileges and logon access to the infrastructure where VirtualBox runs.
Researcher notes
Evidence is limited to vendor-style advisory data. No CWE, exploit details, or affected subversions beyond “prior to 6.1.28” are provided. Validation should focus on version exposure, local privilege boundaries, and whether VirtualBox crash telemetry exists.
Mitigation direction
- Identify VirtualBox installations older than 6.1.28.
- Update VirtualBox using Oracle or operating-system vendor guidance.
- Review Gentoo GLSA-202208-36 if managing Gentoo systems.
- Restrict high-privilege local access to VirtualBox hosts.
- Monitor affected hosts for VirtualBox crashes or unexplained hangs.
Validation and detection
- Inventory installed VirtualBox versions across workstations and virtualization hosts.
- Confirm no production system runs VirtualBox before 6.1.28.
- Review privileged local user access on VirtualBox hosts.
- Check crash logs for repeated VirtualBox hangs or failures.
- Verify remediation against Oracle CPU October 2021 guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-35545 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H1.54.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.7MediumVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.oracle.com/security-alerts/cpuoct2021.htmlCVE reference · x_refsource_MISC
- GLSA-202208-36CVE reference · vendor-advisory, x_refsource_GENTOO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.