{"id":404870,"date":"2026-08-22T04:47:43","date_gmt":"2026-08-22T04:47:43","guid":{"rendered":"https:\/\/malwaretips.com\/blogs\/?p=404870"},"modified":"2026-08-22T04:47:43","modified_gmt":"2026-08-22T04:47:43","slug":"virtualbox-7-2-16","status":"publish","type":"post","link":"https:\/\/malwaretips.com\/blogs\/virtualbox-7-2-16\/","title":{"rendered":"VirtualBox 7.2.14 is in the August Oracle patch. Take 7.2.16"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">VirtualBox is the host that keeps the lab VMs and the shop test box on one PC. Oracle&#8217;s August Critical Patch Update named Oracle VM VirtualBox 7.2.14 in the Core component. The fix you want is already on the Downloads page as 7.2.16. Quit the running guests, install 7.2.16 over the old build for your host OS, and open Help, About Oracle VirtualBox until it reads 7.2.16. If you use the Extension Pack, install the matching 7.2.16 pack. Guest Additions inside each VM can wait until a quiet moment.<\/p><div id=\"mwtad1482242270\" class=\"gas_fallback-ad_309684--placement_400588\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3957935887\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1536\" height=\"1024\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-vbox-overview.png\" alt=\"Oracle VirtualBox Manager About dialog showing VirtualBox Graphical User Interface Version 7.2.16 on a Windows host\" class=\"wp-image-404868\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-vbox-overview.png 1536w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-vbox-overview-300x200.png 300w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-vbox-overview-1024x683.png 1024w\" sizes=\"auto, (max-width: 1536px) 100vw, 1536px\" \/><figcaption class=\"wp-element-caption\">About should read 7.2.16.<\/figcaption><\/figure>\n\n\n\n<div id=\"mwtad2400673058\" class=\"gas_fallback-ad_309747-ad_309691-placement_400589\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"9589536513\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Overview<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What broke<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">On 18 August 2026 Oracle published the <a href=\"https:\/\/www.oracle.com\/security-alerts\/cspuaug2026.html\" target=\"_blank\" rel=\"noopener\">Critical Patch Update Advisory for August 2026<\/a>. Under Oracle VM VirtualBox, version 7.2.14 is listed as affected in the Core component. The same day, the <a href=\"https:\/\/www.virtualbox.org\/wiki\/Changelog-7.2\" target=\"_blank\" rel=\"noopener\">VirtualBox 7.2 changelog<\/a> records 7.2.16 as released, and the <a href=\"https:\/\/www.virtualbox.org\/wiki\/Downloads\" target=\"_blank\" rel=\"noopener\">VirtualBox Downloads page<\/a> now ships current platform packages at 7.2.16.<\/p>\n\n\n\n<div id=\"mwtad3839726676\" class=\"mwtadp1 mwtadentity-placement\" style=\"margin-top: 50px;margin-bottom: 50px;\"> \r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block; text-align:center;\"\r\n     data-ad-layout=\"in-article\"\r\n     data-ad-format=\"fluid\"\r\n     data-ad-client=\"ca-pub-7750719144850257\"\r\n     data-ad-slot=\"7312657698\"><\/ins>\r\n <\/div><p class=\"wp-block-paragraph\">Oracle&#8217;s advisory lists a large Core set for that train. Five you can hang the click on. <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-71113\" target=\"_blank\" rel=\"noopener\">CVE-2026-71113<\/a> and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-71130\" target=\"_blank\" rel=\"noopener\">CVE-2026-71130<\/a> are the network pair: an unauthenticated attacker with network access via RDP can compromise VirtualBox. In English, that is Remote Display \/ VRDP facing the network. The other three, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-71125\" target=\"_blank\" rel=\"noopener\">CVE-2026-71125<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-71131\" target=\"_blank\" rel=\"noopener\">CVE-2026-71131<\/a>, and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-71141\" target=\"_blank\" rel=\"noopener\">CVE-2026-71141<\/a>, are unauthenticated local Core issues on a 7.2.14 host. Oracle lists more Core CVEs in the same row. Do not wait for a full dump. The floor is 7.2.16.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Oracle has not said these August VirtualBox CVEs are in the wild. CISA has not listed 71113, 71130, 71125, 71131, or 71141 on the <a href=\"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog\" target=\"_blank\" rel=\"noopener\">Known Exploited Vulnerabilities catalog<\/a>. That is not a reason to leave 7.2.14 on a host with guests. Downloads already offers 7.2.16.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Who is in range<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You plus the shop. Any Windows, Mac, or Linux host still on Oracle VM VirtualBox 7.2.14, or any earlier build below 7.2.16, is in range. If Help, About Oracle VirtualBox still shows 7.2.14, 7.2.12, or an older 7.x line, treat the host as in range until About reads 7.2.16.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Home lab PCs, the spare desk machine that only runs a pfSense or Ubuntu guest, and the small-office host with a Windows test VM are all in range. Updating VMware or Hyper-V does not patch VirtualBox.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If Remote Display \/ RDP to a guest is reachable from the LAN or the internet, treat that host as higher urgency. The default for a closed lab is still This week. An exposed RDP path makes Today the honest call.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What the vendor shipped<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>18 August 2026: Oracle CSPU lists Oracle VM VirtualBox 7.2.14 as affected in Core.<\/li>\n<li>18 August 2026: VirtualBox 7.2.16 released on the 7.2 changelog. Current platform packages on Downloads are 7.2.16 for Windows, macOS, and Linux hosts.<\/li>\n<li>Matching Oracle VM VirtualBox Extension Pack 7.2.16 if you use USB 2.0\/3.0, RDP, disk encryption, or the other Extension Pack features.<\/li>\n<li>Guest Additions for 7.2.16 inside each guest when convenient. The host install is the urgent click. Additions are the follow-up.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Download the 7.2.16 package for your host OS from the official Downloads page, quit running VMs, install over the old build, then Help, About Oracle VirtualBox. The line you want is Version 7.2.16. If you keep an Extension Pack, open File, Tools, Extension Pack Manager and install the matching 7.2.16 pack. Do not pull an installer from a random &#8220;VirtualBox update&#8221; mirror.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What this is not<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Not a VMware, Hyper-V, QEMU, or Parallels patch. Those are other products.<\/li>\n<li>Not closed by a Windows Update or Mac App Store click. VirtualBox ships its own packages.<\/li>\n<li>Not done if you downloaded 7.2.16 and never ran the installer, or if About still reads 7.2.14.<\/li>\n<li>Not done if the host is on 7.2.16 but the Extension Pack is still an older 7.2.x pack. Match the pack to the host.<\/li>\n<li>Not on CISA KEV. Oracle has not said 71113, 71130, 71125, 71131, or 71141 is in the wild.<\/li>\n<li>Not a reason to dump every Core CVE from the August CSPU. Five leads are enough. Take 7.2.16.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1536\" height=\"1024\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-vbox-house.png\" alt=\"Do This Now card: Install VirtualBox 7.2.16, in range You plus the shop, urgency This week, then Download 7.2.16\" class=\"wp-image-404869\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-vbox-house.png 1536w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-vbox-house-300x200.png 300w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/do-this-now-vbox-house-1024x683.png 1024w\" sizes=\"auto, (max-width: 1536px) 100vw, 1536px\" \/><figcaption class=\"wp-element-caption\">Install VirtualBox 7.2.16.<\/figcaption><\/figure>\n\n\n\n<div id=\"mwtad2577239990\" class=\"gas_fallback-ad_309748-ad_309691-placement_400590\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3906789406\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Do This Now<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>In range:<\/strong> You plus the shop. Home lab and small-office hosts still on VirtualBox below 7.2.16.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Urgency:<\/strong> This week. If RDP \/ Remote Display to a guest is exposed past the host, treat that box as Today.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the <a href=\"https:\/\/www.virtualbox.org\/wiki\/Downloads\" target=\"_blank\" rel=\"noopener\">VirtualBox Downloads page<\/a>. Take the 7.2.16 package for your host OS (Windows, macOS, or Linux).<\/li>\n<li>Shut down or save-state every running guest. Quit Oracle VM VirtualBox Manager. Run the 7.2.16 installer over the old build.<\/li>\n<li>Open VirtualBox. Help, About Oracle VirtualBox. Confirm Version 7.2.16. If you use the Extension Pack, install Extension Pack 7.2.16 next. Update Guest Additions inside VMs when convenient.<\/li>\n<\/ol>\n\n\n\n<div id=\"mwtad1382408190\" class=\"gas_fallback-ad_309749-ad_309691-placement_400591\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"5354318971\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Who can skip<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Help, About Oracle VirtualBox already shows 7.2.16 or newer, and the Extension Pack (if installed) also reads 7.2.16.<\/li>\n<li>No VirtualBox on any PC you administer. The lab runs only VMware, Hyper-V, or another hypervisor.<\/li>\n<li>VMware Workstation or Hyper-V only in the shop, and VirtualBox is not installed on the shared hosts.<\/li>\n<li>A locked image that IT pushes. Ask for host package 7.2.16 plus matching Extension Pack. That is not a skip for the fleet; it is a different delivery path.<\/li>\n<\/ul>\n\n\n\n<div id=\"mwtad1026086411\" class=\"gas_fallback-ad_309750-ad_309691-placement_400592\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"4041237300\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Why it matters<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">VirtualBox sits under the guests you already trust: the firewall appliance, the Windows test desk, the Linux build box. A Core compromise on the host is how a bad path stops being a guest problem and starts being the machine that holds every disk image. You do not need a second exploit story for that to be worth an install over.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The RDP pair matters because Remote Display is the feature people leave on &#8220;just for the lab.&#8221; An unauthenticated network attacker who can reach that RDP path is the story Oracle wrote for 71113 and 71130. If the port is only on localhost, This week is still right. If it is forwarded, on a flat LAN, or reachable from outside, move that host to Today and shut Remote Display until About reads 7.2.16.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The local Core trio still matters on a shared shop PC. Unauthenticated local means a process already on the host can hit Core without a login dance. Home labs share accounts. Small offices share the same &#8220;test&#8221; login. That is enough blast for a This week install.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Oracle did not put an exploited flag on these CVEs. CISA has not added them to KEV. Waiting is still how 7.2.14 sits under a week of guest work while Downloads already offers 7.2.16. If you use RDP, USB passthrough, or encryption, match the Extension Pack to 7.2.16. A host on 7.2.16 with an old pack is a half finish. Guest Additions can follow on the next boot of each VM.<\/p>\n\n\n\n<div id=\"mwtad1234633355\" class=\"gas_fallback-ad_309751-ad_309691-placement_400593\" style=\"margin-top: 50px;margin-bottom: 50px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3690286463\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">The bottom line<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">On the host PC<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open a browser you already trust. Go to the official VirtualBox Downloads page. Do not use a search-ad mirror.<\/li>\n<li>Download VirtualBox 7.2.16 for the host OS that actually runs the hypervisor: Windows, macOS, or your Linux distro package.<\/li>\n<li>In VirtualBox Manager, shut down or save-state every guest. Then File, Exit, or quit the app fully so the old process is gone.<\/li>\n<li>Run the 7.2.16 installer. Accept the upgrade over the existing install. Keep your VM folder path. Restart only if the installer asks.<\/li>\n<li>Launch Oracle VM VirtualBox Manager. Help, About Oracle VirtualBox. You want Version 7.2.16. If it still says 7.2.14 or older, the upgrade did not take. Run the installer again.<\/li>\n<li>If you use the Extension Pack: File, Tools, Extension Pack Manager (wording varies slightly by build). Remove or upgrade the old pack, then install Oracle_VM_VirtualBox_Extension_Pack-7.2.16. Confirm the pack version matches 7.2.16.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">If About never moves<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Confirm you downloaded the host package, not only the Extension Pack or Guest Additions ISO. Quit VirtualBox from the system tray if a leftover Manager is still running, then reinstall 7.2.16. On Windows, end leftover VirtualBox tasks in Task Manager and run the installer again. On Linux, use the package from the same Downloads page, not a third-party repo that still pins 7.2.14.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A shop host locked by an image catalog will not self-update. Ask whoever owns the image to push host 7.2.16 and Extension Pack 7.2.16.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Guests, the other host, and RDP<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>After the host is on 7.2.16, start each guest when convenient. Devices, Insert Guest Additions CD image, then run the installer inside the guest. This can wait a day. The host package cannot.<\/li>\n<li>The laptop in the bag, the spare lab tower, the front-desk test Windows host: same Downloads path tonight. One stale VirtualBox host is enough.<\/li>\n<li>If any guest has Remote Display enabled and that RDP port is reachable past the host, turn it off or block the port until About shows 7.2.16. Then patch.<\/li>\n<li>VMware and Hyper-V hosts in the same shop are a skip for this VirtualBox number.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">What you should see<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Help, About Oracle VirtualBox shows Version 7.2.16 on the host. The Extension Pack Manager, if you use a pack, shows 7.2.16. Guests may still report older Guest Additions until you update them. That is expected for a day. About still reading 7.2.14 after the installer finished is not. Stay on About until the host number is 7.2.16.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When you are done<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">About reads 7.2.16 on every home-lab and shop host that still runs VirtualBox. Extension Pack 7.2.16 is installed where you use it. Exposed Remote Display is off or firewalled until that About line is true. Guest Additions can follow. You needed a new host build. You have it.<\/p>\n\n<div id=\"mwtad4112445163\" class=\"gas_fallback-ad_176819-ad_309691-placement_400595\" style=\"margin-top: 50px;margin-bottom: 50px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"8386082122\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>VirtualBox is the host that keeps the lab VMs and the shop test box on one PC. Oracle&#8217;s August Critical Patch Update named Oracle VM VirtualBox 7.2.14 in the Core component. The fix you want &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"VirtualBox 7.2.14 is in the August Oracle patch. Take 7.2.16\" class=\"read-more button\" href=\"https:\/\/malwaretips.com\/blogs\/virtualbox-7-2-16\/#more-404870\" aria-label=\"Read more about VirtualBox 7.2.14 is in the August Oracle patch. Take 7.2.16\">Read more<\/a><\/p>\n","protected":false},"author":51,"featured_media":404868,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3605],"tags":[],"class_list":["post-404870","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","masonry-post","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/404870","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/users\/51"}],"replies":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/comments?post=404870"}],"version-history":[{"count":1,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/404870\/revisions"}],"predecessor-version":[{"id":404883,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/404870\/revisions\/404883"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media\/404868"}],"wp:attachment":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media?parent=404870"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/categories?post=404870"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/tags?post=404870"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}