What is the severity of CVE-2026-21984?

CVE-2026-21984 has a CVSS v3 score of 7.5, which is classified as High severity.

Is there an exploit available for CVE-2026-21984?

No known public exploits are currently available for CVE-2026-21984.

Is there a patch available for CVE-2026-21984?

Yes, patches are available for CVE-2026-21984. Check the vendor advisories for update instructions.

CVE-2026-21984 - CVE Details, Severity, and Analysis

Severity Scores

CVSS v37.5

CVSS v20.0

Priority Score418.0

EPSS Score0.0

High

Exploitation LikelihoodMinimal

0.00%EPSS

Very low probability of exploitation

Monitor and patch as resources allow

0.00%

EPSS

7.5

CVSS

No

Exploit

Yes

Patch

Low Priority

no major risk factors

EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.

Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

CVSS v3 Breakdown

Attack Vector:Local

Attack Complexity:High

Privileges Required:High

User Interaction:Network

Scope:Changed

Confidentiality:High

Integrity:High

Availability:High