← Vulnerability feed

Vulnerability record · CVE-2018-3294 · published 17 October 2018

CVE-2018-3294: Oracle vm virtualbox vulnerability

Oracle · Vm Virtualbox

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows low privileged attacker with network access via VRDP to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).

9.0 CVSS 3.0 Critical EPSS 2.3% · top 17.3%
9.0CVSS 3.0 base score, v2 6.0
2.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows low privileged attacker with network access via VRDP to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html PatchVendor Advisory
http://www.securityfocus.com/bid/105624 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041887 Third Party AdvisoryVDB Entry
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html PatchVendor Advisory
http://www.securityfocus.com/bid/105624 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041887 Third Party AdvisoryVDB Entry

Track CVE-2018-3294 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-2725Oracle WebLogic Server Web Services deserialization RCEOracle WebLogic Server's Web Services subcomponent contains an injection flaw (CWE-74) that allows unauthenticated remote code execution over HTTP. I…KEVEPSS 100%analysed10.0CVE-2015-8104Xen vulnerabilityThe KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic o…EPSS 2.5%10.0CVE-2015-0235glibc gethostbyname heap buffer overflow (GHOST)CVE-2015-0235 is a heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2 and other 2.x versions before 2.18. It is reach…EPSS 95%analysed9.1CVE-2016-5605Oracle vm virtualbox improper access control vulnerabilityUnspecified vulnerability in the Oracle VM VirtualBox component before 5.1.4 in Oracle Virtualization allows remote attackers to affect confidentiali…EPSS 2.4%8.8CVE-2024-21113Oracle vm virtualbox improper access control vulnerabilityVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.1…EPSS 0.39%8.8CVE-2024-21114Oracle vm virtualbox improper access control vulnerabilityVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.1…EPSS 0.39%8.8CVE-2024-21115Oracle vm virtualbox improper access control vulnerabilityVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.1…EPSS 0.45%8.8CVE-2024-21112Oracle vm virtualbox improper access control vulnerabilityVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.1…EPSS 0.39%

Source: NIST National Vulnerability Database (record CVE-2018-3294), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.