What is the severity of CVE-2026-21963?

CVE-2026-21963 has a CVSS v3 score of 6, which is classified as Medium severity.

Is there an exploit available for CVE-2026-21963?

No known public exploits are currently available for CVE-2026-21963.

Is there a patch available for CVE-2026-21963?

Yes, patches are available for CVE-2026-21963. Check the vendor advisories for update instructions.

CVE-2026-21963 - CVE Details, Severity, and Analysis

Severity Scores

CVSS v36.0

CVSS v20.0

Priority Score153.0

EPSS Score0.0

Medium

Exploitation LikelihoodMinimal

0.00%EPSS

Very low probability of exploitation

Monitor and patch as resources allow

0.00%

EPSS

6.0

CVSS

No

Exploit

Yes

Patch

Low Priority

no major risk factors

EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.

Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

CVSS v3 Breakdown

Attack Vector:Local

Attack Complexity:Local

Privileges Required:High

User Interaction:Network

Scope:Changed

Confidentiality:High

Integrity:Network

Availability:Network