What is the severity of CVE-2026-21986?

CVE-2026-21986 has a CVSS v3 score of 7.1, which is classified as High severity.

Is there an exploit available for CVE-2026-21986?

No known public exploits are currently available for CVE-2026-21986.

Is there a patch available for CVE-2026-21986?

Yes, patches are available for CVE-2026-21986. Check the vendor advisories for update instructions.

CVE-2026-21986 - CVE Details, Severity, and Analysis

Severity Scores

CVSS v37.1

CVSS v20.0

Priority Score312.0

EPSS Score0.0

High

Exploitation LikelihoodMinimal

0.00%EPSS

Very low probability of exploitation

Monitor and patch as resources allow

0.00%

EPSS

7.1

CVSS

No

Exploit

Yes

Patch

Low Priority

no major risk factors

EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.

Description

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. Note: This vulnerability applies to Windows VMs only. CVSS 3.1 Base Score 7.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).

CVSS v3 Breakdown

Attack Vector:Local

Attack Complexity:Local

Privileges Required:Network

User Interaction:Network

Scope:Changed

Confidentiality:Network

Integrity:Network

Availability:High