SecBoard
Zurück zur CVE-Übersicht

CVE-2026-87268

HIGH(7.8)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 7.8 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.8

Technische Schwere

Beschreibung

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Windows host only. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detects suspicious process creation or modification activities related to VirtualBox processes, especially those initiated by low-privileged users, which could indicate an attempt to exploit the vulnerability. Specific process names and typical execution paths for VirtualBox should be monitored.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFolderPath contains "VirtualBox" or FolderPath contains "VirtualBox"
| where ActionType == "ProcessCreated" or ActionType == "FileModified"
| where InitiatingProcessAccountSid in ( "S-1-5-32-545", "S-1-5-32-544" ) // Low privileged users (Users, Administrators - adjust as needed)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFolderPath, FileName, FolderPath, ProcessCommandLine, ActionType

Splunk SPL

(sourcetype=WinEventLog:Security EventCode=4688 OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1) (ParentProcessName=*VirtualBox* OR ProcessName=*VirtualBox*)
| search (User_Name!=*SYSTEM* AND User_Name!=*NETWORK SERVICE* AND User_Name!=*LOCAL SERVICE*)
| table _time, host, User_Name, ParentProcessName, ProcessName, CommandLine

Sigma

title: VirtualBox Takeover Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects suspicious process creation or modification activities related to VirtualBox processes by low-privileged users.
author: SecBoard
date: 2024/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: 'VirtualBox.exe'
    - ParentImage|endswith: 'VirtualBox.exe'
  filter:
    - User|contains: ['SYSTEM', 'NETWORK SERVICE', 'LOCAL SERVICE']
  condition: selection and not filter
level: high

Elastic ES|QL

from process where process.executable.path : "*VirtualBox*" or process.parent.executable.path : "*VirtualBox*"
| where event.action : ("process_start", "file_change")
| where not user.name : ("SYSTEM", "NETWORK SERVICE", "LOCAL SERVICE")
| select @timestamp, host.name, user.name, process.parent.executable.path, process.executable.path, process.command_line, event.action

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen