CVE-2026-60158 in VM VirtualBox
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle VM VirtualBox version 7.2.12, specifically in the Core component of the Oracle Virtualization product suite. The flaw represents a significant security concern as it can be exploited by attackers who already possess legitimate login credentials to the system hosting the virtualization environment. The vulnerability's classification as difficult to exploit indicates that while sophisticated attack techniques are required, the potential for successful compromise remains substantial given the right conditions and attacker motivation.
The technical nature of this vulnerability stems from insufficient access controls or privilege validation mechanisms within the VirtualBox core functionality. Attackers with low-privilege accounts can leverage this weakness to gain unauthorized access to critical system resources. The CVSS 3.1 score of 6.4 reflects the moderate severity impact, specifically targeting integrity and availability aspects of the system. The attack vector AV:L indicates local access requirements, meaning the attacker must already have operational presence on the target system, while the high attack complexity AC:H suggests that specialized knowledge or techniques are necessary to exploit the flaw effectively.
The operational impact of this vulnerability extends beyond the immediate VirtualBox environment, creating a scope change that can affect additional Oracle products within the virtualization ecosystem. This cascading effect demonstrates how virtualization platforms serve as critical infrastructure components where a single vulnerability can propagate across multiple systems and applications. Successful exploitation enables attackers to create, delete, or modify any data accessible through the VirtualBox interface, potentially compromising entire virtual machine configurations and their associated data stores.
The availability impact represents a partial denial of service condition that could disrupt virtualization operations without completely shutting down the system. This partial DOS capability allows attackers to selectively disable specific services or functions within VirtualBox while maintaining other operational capabilities. The integrity impact level of HIGH (I:H) indicates that unauthorized modifications can occur to critical system data, potentially leading to complete compromise of virtual machine environments and associated sensitive information. Organizations using Oracle VM VirtualBox 7.2.12 should immediately implement mitigations including patch updates, enhanced access controls, and monitoring for unusual activity patterns within their virtualization infrastructure.
This vulnerability aligns with CWE-284 (Improper Access Control) and represents a classic privilege escalation scenario where insufficient validation allows lower-privileged users to gain elevated system access. The ATT&CK framework would categorize this under Privilege Escalation techniques, specifically leveraging local system access to expand attack surface. Organizations should consider implementing network segmentation, mandatory access controls, and regular security assessments to reduce exposure to such vulnerabilities that can compromise virtualization environments serving as foundational infrastructure components for enterprise computing operations.