Security readout for executives and security teams
Plain-English summary
CVE-2026-21986 is a denial-of-service issue in Oracle VM VirtualBox Core affecting versions 7.1.14 and 7.2.4. An unauthenticated person with local logon access to the system running VirtualBox could cause VirtualBox to hang or repeatedly crash. Oracle notes it applies to Windows VMs only.
Executive priority
Treat as high priority for environments relying on VirtualBox availability, especially shared labs, developer workstations, CI systems, or training platforms. Business risk is service disruption rather than confirmed data compromise. Prioritize systems where many users have host logon access or where VM outages would interrupt operations.
Technical view
Oracle rates this CVSS 7.1 high: AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. The vulnerability is locally reachable, low complexity, requires no privileges or user interaction, and affects availability only. Scope change indicates impact may extend beyond VirtualBox. The vendor advisory identifies supported affected versions 7.1.14 and 7.2.4.
Likely exposure
Exposure is most relevant where Oracle VM VirtualBox 7.1.14 or 7.2.4 runs Windows VMs and untrusted or broad users can log on to the host infrastructure. Internet-only exposure is not indicated by the CVSS vector or Oracle description.
Exploitation context
Sources do not indicate active exploitation, and the CVE is not marked in KEV. Exploitation requires logon access to the infrastructure where VirtualBox executes, but no privileges. The documented impact is complete denial of service through hangs or repeatable crashes, not data theft or code execution.
Researcher notes
Evidence is limited to Oracle/CVE descriptions. No CWE, root-cause details, exploit primitives, or patch version details are included in the provided sources. The notable constraints are local access, no privileges, Windows VMs only, availability impact, and scope change.
Mitigation direction
- Review Oracle's January 2026 Critical Patch Update guidance for this CVE.
- Prioritize VirtualBox hosts running affected versions with Windows VMs.
- Restrict local logon access to VirtualBox host infrastructure.
- Reduce untrusted multi-user access to affected VirtualBox environments.
- Monitor Oracle for any updated workaround or patch instructions.
Validation and detection
- Inventory Oracle VM VirtualBox versions across endpoints, labs, and build systems.
- Identify hosts running VirtualBox 7.1.14 or 7.2.4.
- Confirm whether those deployments run Windows VMs.
- Review who has logon access to VirtualBox host infrastructure.
- Check Oracle advisory status before closing remediation tickets.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-21986 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H2.54Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- Oracle AdvisoryCVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.