VirtualBox vulnerabilities and fixes

CVEs that mention VirtualBox, ranked by priority. 21 tracked.

VirtualBox has 21 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-08-18. Highest priority: CVE-2026-71130 (score 41/100).

• CVE-2026-71130 HIGH 8.2 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71113 HIGH 7.5 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71131 HIGH 8.6 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71129 HIGH 8.2 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71126 HIGH 7.8 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71141 HIGH 7.7 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71116 HIGH 7.5 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71136 HIGH 7.3 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71138 HIGH 7.3 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71114 MEDIUM 6.0 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71115 MEDIUM 6.0 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71125 MEDIUM 6.1 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71127 MEDIUM 6.0 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71128 MEDIUM 6.0 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71135 MEDIUM 6.0 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71137 MEDIUM 6.0 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71134 MEDIUM 5.7 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71151 MEDIUM 5.6 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71132 MEDIUM 5.3 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71139 MEDIUM 4.4 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)
• CVE-2026-71140 LOW 3.4 DOWNGRADE Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)

FAQ

How do I fix VirtualBox vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is VirtualBox being exploited right now?

None of the tracked VirtualBox CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which VirtualBox CVE should I patch first?

CVE-2026-71130 currently ranks highest (41/100): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

← Back to latest CVEs