CERT-FR Flags Oracle Virtualization Flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT-FR advisory details multiple vulnerabilities in Oracle VM VirtualBox and Enterprise Manager for Virtualization enabling RCE, DoS, and data exposure.
CERT-FR has issued an advisory summarizing multiple vulnerabilities affecting Oracle Virtualization products, based on Oracle's October 2026 Critical Patch Update (cpuoct2026). Affected products include Oracle Enterprise Manager for Virtualization version 13.5 and Oracle VM VirtualBox versions 7.2.16 and 7.2.20. The vulnerabilities span several risk categories: remote arbitrary code execution, remote denial of service, bypass of security policy, and breach of data confidentiality.
Seven CVEs are referenced (CVE-2025-48734, CVE-2026-101598, CVE-2026-101599, CVE-2026-87301, CVE-2026-87303, CVE-2026-87311, CVE-2026-87322), though the advisory does not provide per-CVE technical detail, instead directing readers to Oracle's own security bulletin for patch information. No indication is given that these vulnerabilities are being actively exploited in the wild; this is a standard vendor patch advisory relay. Defenders operating Oracle VM VirtualBox or Enterprise Manager for Virtualization should consult Oracle's cpuoct2026 bulletin and apply the relevant patches, prioritizing systems where remote code execution is possible, particularly virtualization hosts that may provide an attacker a path to host-level compromise or guest escape scenarios typical of hypervisor vulnerabilities.
As this is a CERT bulletin aggregating vendor-disclosed CVEs rather than original research or campaign reporting, it should be treated as a patch-management action item rather than evidence of ongoing attacker activity.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1354
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,960 reports from 143 sources, 519 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs