VirtualBox 7.2.22 shipped October 20, 2026, described by Oracle only as "a maintenance release with security-related fixes," with no CVE list published. It landed the same day as Oracle's October Critical Patch Update, strongly indicating it's Oracle's VirtualBox contribution to this quarter's security cycle. VirtualBox 7.1 has been unsupported since March 31, 2026, so those users should migrate to the still-supported 7.2 line. 7.2 users should jump to 7.2.22 to pick up the latest fixes, and ARM VM owners should shut down saved machines before upgrading due to a 7.1-to-7.2 snapshot incompatibility.

Oracle ships VirtualBox 7.2.22 and won't say what it actually fixes

Oracle just released VirtualBox 7.2.22, and the changelog is frustratingly vague on purpose. The company describes the new build as "a maintenance release with security-related fixes." No CVE numbers. No list of affected components. Just enough wording to tell you to update.

It's not unusual for a vendor to hold back details on a security patch. But the timing here is a dead giveaway that this isn't routine. VirtualBox 7.2.22 landed on October 20, 2026, the exact same day Oracle delivered its October Critical Patch Update.

Let's connect the dots. October 20 is the third Tuesday of the month, which is Oracle's regular CPU cadence. Oracle has been hitting that schedule all year, with published dates running August 18, September 15, and October 20. So it's a fairly safe bet that 7.2.22 is Oracle's VirtualBox contribution to this quarter's critical update.

The official news page reads like typical Oracle boilerplate. "Oracle today released a 7.2 maintenance release which improves stability and fix regressions. See the Changelog for details." The only thing that separates 7.2.22 from a normal maintenance build is that appended "security-related fixes" phrase. Everything else is the usual maintenance tone.

Why the silence matters more than you'd think

The absence of a bulleted fix list is actually a signal in itself. When Oracle names specific CVEs, it's usually comfortable. When it stays vague, it's often because it's coordinating disclosure, waiting on a published advisory, or simply doesn't want to hand attackers a cheat sheet for the still-unpatched versions.

For context, that vagueness lines up with a 2026 where Oracle has been busy. The documented vulnerability picture for VirtualBox this year spans privilege escalation, denial of service, access-control failures, and even at least one flaw that was described as remotely exploitable without authentication. That last category, unauthenticated remote code execution against a hypervisor, is precisely the kind of problem that would prompt a dedicated, opaque security release.

It's worth being clear about what you're looking at here. The CVEs floating around SentinelOne, Tenable, and the NVD are context, not a confirmed itemized list of what 7.2.22 closes. Oracle hasn't published the specifics. Treat those entries as a window into the threat environment 7.2.22 arrived in, not a checklist.

The deeper point is what VirtualBox actually sits between. It mediates your guest workloads against your host, holding your VM disk images, saved states, clipboards, shared folders, and network connections. A successful exploit doesn't just wreck a virtual machine. It can cross the isolation line. That's why Oracle takes these fixes seriously even when several require a local, high-privilege login first.

Are you still running something old?

Here's the angle that bites the most people. VirtualBox 7.1 lost maintenance support back on March 31, 2026. Its final build was 7.1.18. Anyone still on that line is running unsupported software, which means it simply won't get these October security patches.

The 7.2 line, by contrast, is still under active maintenance, and 7.2.22 is the newest build. If you're on 7.1, your natural target is 7.2. If you're already on 7.2 but sitting behind an older build like 7.2.8, 7.2.10, or 7.2.14, then 7.2.22 is the one to grab.

One wrinkle worth knowing before you upgrade. The 7.2 line broke compatibility with saved states and snapshots of ARM virtual machines created under 7.1. Oracle explicitly told users to shut down, not just save, any ARM VMs before moving, because those 7.1-era Arm snapshots will simply stop working. And a reboot afterward is sensible, since updated hypervisor kernel modules usually need a clean load.

The practical advice: update to 7.2.22 if you're on the 7.2 line, and plan your migration off 7.1 entirely. Security teams should inventory the affected builds against the documented CVEs and give priority to anything unauthenticated or remotely reachable.

Head here to download the new release.