← Vulnerability feed

Vulnerability record · CVE-2016-5605 · published 25 October 2016

CVE-2016-5605: Oracle vm virtualbox improper access control vulnerability

Oracle · Vm Virtualbox

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.1.4 in Oracle Virtualization allows remote attackers to affect confidentiality and integrity via vectors related to VRDE.

9.1 CVSS 3.0 Critical EPSS 2.4% · top 16.4% CWE-284 · Improper access control
9.1CVSS 3.0 base score, v2 6.4
2.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Unspecified vulnerability in the Oracle VM VirtualBox component before 5.1.4 in Oracle Virtualization allows remote attackers to affect confidentiality and integrity via vectors related to VRDE.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html PatchVendor Advisory
http://www.securityfocus.com/bid/93685
http://www.securitytracker.com/id/1037053
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html PatchVendor Advisory
http://www.securityfocus.com/bid/93685
http://www.securitytracker.com/id/1037053

Track CVE-2016-5605 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-2725Oracle WebLogic Server Web Services deserialization RCEOracle WebLogic Server's Web Services subcomponent contains an injection flaw (CWE-74) that allows unauthenticated remote code execution over HTTP. I…KEVEPSS 100%analysed10.0CVE-2015-8104Xen vulnerabilityThe KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic o…EPSS 2.5%10.0CVE-2015-0235glibc gethostbyname heap buffer overflow (GHOST)CVE-2015-0235 is a heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2 and other 2.x versions before 2.18. It is reach…EPSS 95%analysed9.0CVE-2018-3294Oracle vm virtualbox vulnerabilityVulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to…EPSS 2.3%8.8CVE-2024-21113Oracle vm virtualbox improper access control vulnerabilityVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.1…EPSS 0.39%8.8CVE-2024-21114Oracle vm virtualbox improper access control vulnerabilityVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.1…EPSS 0.39%8.8CVE-2024-21115Oracle vm virtualbox improper access control vulnerabilityVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.1…EPSS 0.45%8.8CVE-2024-21112Oracle vm virtualbox improper access control vulnerabilityVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.1…EPSS 0.39%

Source: NIST National Vulnerability Database (record CVE-2016-5605), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.