The 7.1.14 and 7.2.4 versions of VM VirtualBox installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported     versions that are affected are 7.1.14 and 7.2.4. Difficult to exploit vulnerability allows unauthenticated     attacker with access to the physical communication segment attached to the hardware where the Oracle VM     VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can     result in takeover of Oracle VM VirtualBox. (CVE-2026-21982)

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported     versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged     attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM     VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact     additional products (scope change). Successful attacks of this vulnerability can result in takeover of     Oracle VM VirtualBox. (CVE-2026-21955, CVE-2026-21956, CVE-2026-21987, CVE-2026-21988, CVE-2026-21990)

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported     versions that are affected are 7.1.14 and 7.2.4. Difficult to exploit vulnerability allows high privileged     attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM     VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact     additional products (scope change). Successful attacks of this vulnerability can result in takeover of     Oracle VM VirtualBox. (CVE-2026-21957, CVE-2026-21983, CVE-2026-21984)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle VM VirtualBox (January 2026 CPU)

medium Nessus Plugin ID 296414

Version 1.2

Version 1.1

Version 1.2 Feb 3, 2026, 2:33 PM CVSS metrics ("CVSSv3 score" set to 6.4) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSSv3 score source (changed from "CVE-2026-21990" to none) CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Plugin Feed: 202602031433
Version 1.1 Jan 23, 2026, 11:44 PM New Plugin Feed: 202601232344