# CERT-FR Flags Oracle Virtualization Flaws

Published: 2026-10-21 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/6da1724f-fabe-52ae-bca0-9755e8b84da0/cert-fr-flags-oracle-virtualization-flaws

> CERT-FR advisory details multiple vulnerabilities in Oracle VM VirtualBox and Enterprise Manager for Virtualization enabling RCE, DoS, and data exposure.

CERT-FR has issued an advisory summarizing multiple vulnerabilities affecting Oracle Virtualization products, based on Oracle's October 2026 Critical Patch Update (cpuoct2026). Affected products include Oracle Enterprise Manager for Virtualization version 13.5 and Oracle VM VirtualBox versions 7.2.16 and 7.2.20. The vulnerabilities span several risk categories: remote arbitrary code execution, remote denial of service, bypass of security policy, and breach of data confidentiality.

Seven CVEs are referenced (CVE-2025-48734, CVE-2026-101598, CVE-2026-101599, CVE-2026-87301, CVE-2026-87303, CVE-2026-87311, CVE-2026-87322), though the advisory does not provide per-CVE technical detail, instead directing readers to Oracle's own security bulletin for patch information. No indication is given that these vulnerabilities are being actively exploited in the wild; this is a standard vendor patch advisory relay. Defenders operating Oracle VM VirtualBox or Enterprise Manager for Virtualization should consult Oracle's cpuoct2026 bulletin and apply the relevant patches, prioritizing systems where remote code execution is possible, particularly virtualization hosts that may provide an attacker a path to host-level compromise or guest escape scenarios typical of hypervisor vulnerabilities.

As this is a CERT bulletin aggregating vendor-disclosed CVEs rather than original research or campaign reporting, it should be treated as a patch-management action item rather than evidence of ongoing attacker activity.

## Mentioned in this report

- Vulnerabilities: CVE-2025-48734, CVE-2026-101598, CVE-2026-101599, CVE-2026-87301, CVE-2026-87303, CVE-2026-87311, CVE-2026-87322

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1354

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6da1724f-fabe-52ae-bca0-9755e8b84da0/cert-fr-flags-oracle-virtualization-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup