CVE-2019-2721
Status: ModifiedHigh (8.8)—💥 Exploit
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS
- Version: 3.0
- Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Base score: 8.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 2.15%
- Percentile among all scored CVEs: 82
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
💥 Public exploits
Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.
- Published on Exploit-DB · VirtualBox 6.0.4 r128413 - COM RPC Interface Code Injection Host Privilege Escalation (4/24/2019)
Affected technologies (1)
CWEs
- NVD-CWE-noinfo
References
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.exploit-db.com/exploits/46747/
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.exploit-db.com/exploits/46747/
Raw JSON (NVD)
Show
{
"id": "CVE-2019-2721",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2019-2721",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-10-02T15:55:41.659435Z"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.6,
"accessVector": "LOCAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.0",
"baseScore": 8.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 6,
"exploitabilityScore": 2
}
]
},
"affected": [
{
"source": "secalert_us@oracle.com",
"affectedData": [
{
"vendor": "Oracle Corporation",
"product": "VM VirtualBox",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "5.2.28",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "6.0.6",
"versionType": "custom"
}
]
}
]
}
],
"published": "2019-04-23T19:32:57.163",
"references": [
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html",
"source": "secalert_us@oracle.com"
},
{
"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "secalert_us@oracle.com"
},
{
"url": "https://www.exploit-db.com/exploits/46747/",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "secalert_us@oracle.com"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.exploit-db.com/exploits/46747/",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.28 and prior to 6.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)."
},
{
"lang": "es",
"value": "Vulnerabilidad en el componente Oracle VM VirtualBox de Oracle Virtualization (subcomponente: Core). Las versiones soportadas que se ven afectadas son anteriores a la 5.2.28 y anteriores a la 6.0.6. La vulnerabilidad, que es fácilmente explotable, permite a los atacantes con privilegios bajos acceder a la infraestructura donde se ejecuta Oracle VM VirtualBox para comprometer a Oracle VM VirtualBox. Aunque la vulnerabilidad se encuentra en Oracle VM VirtualBox, los ataques pueden tener un impacto significativo en productos adicionales. Los ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (impactos en la confidencialidad, integridad y disponibilidad). Vector CVSS: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)."
}
],
"lastModified": "2026-06-17T02:34:26.353",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EE0B277C-82A6-443A-A040-EB710263F1CA",
"versionEndExcluding": "5.2.28"
},
{
"criteria": "cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "91548A4A-F9BA-4929-8416-2733B500C10D",
"versionEndExcluding": "6.0.6",
"versionStartIncluding": "6.0.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secalert_us@oracle.com"
}