Search: “Oracle VirtualBox”

2 stories

ZDI publishes ZDI-26-644 for CVE-2026-60155, a race condition local privilege escalation in Oracle VirtualBox VMSVGA, rated CVSS 7.5.

Zero Day Initiative published advisory ZDI-26-644 describing a race condition in Oracle VirtualBox's VMSVGA component. Local attackers who already execute high-privileged code on the guest system can escalate privileges on affected installations. ZDI rated the issue CVSS 7.5 and assigned CVE-2026-60155.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoAdvisory 6 sources CVE-2026-60155

Oracle Corporation security advisory (AV26-929)

CCCS relays Oracle's September 2026 Critical Patch Update fixing vulnerabilities across WebLogic, Database, E-Business Suite, PeopleSoft, Siebel, and dozens more products.

The Canadian Centre for Cyber Security (AV26-929) relays Oracle's September 2026 Critical Security Patch Update, which addresses vulnerabilities in dozens of product families as of September 15, 2026. Affected products include Oracle WebLogic Server, Database Server, E-Business Suite, Fusion Middleware, PeopleSoft Enterprise, Siebel Applications, GraalVM, VirtualBox, Coherence, and numerous banking and communications suites. The bulletin lists no CVE identifiers and encourages administrators to review Oracle's advisory and apply patches.

Canadian Centre for Cyber SecuritySep 16, 19:29 UTC · 7h agoAdvisory 3 sources

Search: “Oracle VirtualBox”

ZDI-26-644: Oracle VirtualBox VMSVGA Race Condition Local Privilege Escalation Vulnerability

Oracle Corporation security advisory (AV26-929)