Quick answers
- Is CVE-2026-87283 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-87283 being exploited in the wild.
- How severe is CVE-2026-87283?
- Medium severity, with a CVSS score of 6, published 15 September 2026.
- Which products and versions are affected?
- Oracle Vm Virtualbox 7.2.16.
- Is there a fix for CVE-2026-87283?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-87283 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-87283?
- Check whether you run Oracle Vm Virtualbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a denial-of-service vulnerability in Oracle VM VirtualBox Core component, triggered via an easily exploitable vector. The vulnerability requires high privilege access (PR:H) and local logon to the infrastructure (AV:L) where VirtualBox is running, with no user interaction needed (UI:N). A successful exploit causes a hang or repeated crash (complete DoS) of the VirtualBox process. The vulnerability has a scope change (S:C), meaning exploitation may impact connected products beyond VirtualBox. Patch availability for version 7.2.16 is not detailed in the advisory; users should consult Oracle's official security bulletins for mitigation guidance.
Affected products
- Oracle VM VirtualBox 7.2.16
Timeline
- 2026-09-15: disclosed