# CERT-FR Flags Oracle Virtualization Vulnerabilities

Published: 2026-10-21 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/7feac57c-2094-5d66-956d-78d17a4529e8/cert-fr-flags-oracle-virtualization-vulnerabilities

> CERT-FR advisory lists multiple vulnerabilities in Oracle VM VirtualBox and Enterprise Manager for Virtualization enabling RCE, DoS, and data exposure.

CERT-FR has issued an advisory summarizing multiple vulnerabilities affecting Oracle Virtualization products, based on Oracle's October 2026 Critical Patch Update (cpuoct2026). Affected products include Oracle Enterprise Manager for Virtualization version 13.5 and Oracle VM VirtualBox versions 7.2.16 and 7.2.20. The vulnerabilities, tracked under seven CVE identifiers, collectively allow an attacker to achieve remote arbitrary code execution, remote denial of service, and breach of data confidentiality, as well as potential bypass of security policies.

No evidence of active exploitation in the wild is mentioned in the advisory. CERT-FR recommends administrators consult Oracle's official security bulletin for patch details and apply fixes according to Oracle's guidance. Given the breadth of impact (RCE, DoS, confidentiality loss) across widely deployed virtualization software, organizations running affected VirtualBox or Enterprise Manager versions should prioritize patching promptly, particularly in environments where VirtualBox is used to run untrusted or externally-sourced guest images, which could expose host systems to guest-to-host escape style attacks.

## Mentioned in this report

- Vulnerabilities: CVE-2025-48734, CVE-2026-101598, CVE-2026-101599, CVE-2026-87301, CVE-2026-87303, CVE-2026-87311, CVE-2026-87322

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1354

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7feac57c-2094-5d66-956d-78d17a4529e8/cert-fr-flags-oracle-virtualization-vulnerabilities.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup