/
← Voltar ao feed
high

CERT-FR: Multiple vulnerabilities in Oracle Virtualization (VirtualBox, Enterprise Manager) enable RCE, DoS and data disclosure

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 21:00 · coletado há 1 dia

CERT-FR advisory CERTFR-2026-AVI-1354 reports multiple vulnerabilities in Oracle Virtualization products, fixed in the Oracle Critical Patch Update bulletin cpuoct2026 of 20 October 2026. According to the advisory, an attacker could exploit some of them to achieve remote arbitrary code execution, remote denial of service and breach of data confidentiality. The advisory also lists security policy bypass among the impacts. It does not mention active exploitation, IOCs or attribution.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1354 covers several vulnerabilities in Oracle Virtualization: Oracle VM VirtualBox 7.2.16 and 7.2.20, and Oracle Enterprise Manager for Virtualization 13.5. The CVEs are CVE-2025-48734, CVE-2026-101598, CVE-2026-101599, CVE-2026-87301, CVE-2026-87303, CVE-2026-87311 and CVE-2026-87322. According to the advisory, some of them allow remote arbitrary code execution, remote denial of service and loss of data confidentiality, and security policy bypass is also listed. The advisory does not map impacts to individual CVEs, nor give CVSS scores, attack vectors, required privileges or the exact fixed versions. The fixes are in Oracle's Critical Patch Update cpuoct2026 of 20 October 2026.

Como funciona

The articles do not describe how the vulnerable processes work, which component receives the attacker's input or at which step it fails. The advisory only lists the possible impacts, so any mechanism for individual CVEs would be speculation. Defenders should consult the Oracle bulletin for per-CVE details.

Por que é vulnerável

The root causes are not stated in the advisory or the story. There is no information on whether they are memory-safety bugs, missing checks, logic errors or other classes, nor on why they went unnoticed. The only remediation described is applying the Oracle October 2026 Critical Patch Update.

Como foi descoberta

The CERT-FR advisory, published on 21 October 2026, only says that multiple vulnerabilities were discovered in Oracle Virtualization; it does not say who found them or how they were reported. They were disclosed through Oracle's Critical Patch Update bulletin cpuoct2026 of 20 October 2026. The advisory does not mention active exploitation, IOCs or attribution.

Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 13:21.

Detalhes técnicos

  • Affected: Oracle Enterprise Manager for Virtualization 13.5; Oracle VM VirtualBox 7.2.16 and 7.2.20.
  • CVEs referenced: CVE-2025-48734, CVE-2026-101598, CVE-2026-101599, CVE-2026-87301, CVE-2026-87303, CVE-2026-87311, CVE-2026-87322.
  • The advisory does not map impacts to individual CVEs, nor does it give CVSS scores or attack vectors.

Remediação

  • Consult the Oracle security bulletin cpuoct2026 (20 October 2026) to obtain the patches.
  • Apply the October 2026 Critical Patch Update to the affected VirtualBox and Enterprise Manager for Virtualization installations.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 20/10/2026 21:00 · coletado 22/10 13:01 primeiro registro

    CERT-FR: Multiple vulnerabilities in Oracle Virtualization (VirtualBox, Enterprise Manager) enable RCE, DoS and data disclosure

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1354 reports multiple vulnerabilities in Oracle Virtualization products, fixed in the Oracle Critical Patch Update bulletin cpuoct2026 of 20 October 2026. According to the advisory, an attacker could exploit some of them to achieve remote arbitrary code execution, remote denial of service and breach of data confidentiality. The advisory also lists security policy bypass among the impacts. It does not mention active exploitation, IOCs or attribution.

    Technical Details

    • Affected: Oracle Enterprise Manager for Virtualization 13.5; Oracle VM VirtualBox 7.2.16 and 7.2.20.
    • CVEs referenced: CVE-2025-48734, CVE-2026-101598, CVE-2026-101599, CVE-2026-87301, CVE-2026-87303, CVE-2026-87311, CVE-2026-87322.
    • The advisory does not map impacts to individual CVEs, nor does it give CVSS scores or attack vectors.

    Remediation

    • Consult the Oracle security bulletin cpuoct2026 (20 October 2026) to obtain the patches.
    • Apply the October 2026 Critical Patch Update to the affected VirtualBox and Enterprise Manager for Virtualization installations.