CVE-2026-60161 in VM VirtualBox
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle VM VirtualBox's core component and affects version 7.2.12, representing a significant security risk that can be exploited by unauthenticated attackers who have already gained access to the underlying infrastructure where VirtualBox operates. The vulnerability's classification as easily exploitable indicates that attackers can leverage it without requiring specialized skills or extensive preparation, making it particularly dangerous in environments where attackers may already have some level of system access. The CVSS 3.1 base score of 6.1 reflects a moderate to high severity threat with specific impacts to integrity and availability, while the vector analysis shows local attack access (AV:L) with low complexity (AC:L) and requiring only user interaction (UI:R) from someone other than the attacker.
The technical flaw manifests as an insufficient authorization mechanism that allows attackers to compromise VirtualBox operations through a combination of infrastructure access and human interaction requirements. This vulnerability enables attackers to cause complete denial of service conditions through hangs or repeated crashes, effectively rendering the virtualization environment unusable for legitimate users. Additionally, the flaw grants unauthorized capabilities to modify data within VirtualBox's accessible storage systems, allowing for potential data corruption, deletion, or manipulation of virtual machine configurations and associated information. The attack requires human interaction from individuals other than the attacker, suggesting that social engineering or insider threat elements may be involved in successful exploitation scenarios.
The operational impact of this vulnerability extends beyond simple service disruption to include potential data integrity compromise and complete system availability loss. Organizations relying on Oracle VM VirtualBox for virtual machine management face risks of unauthorized modifications to critical virtual environments, potentially affecting multiple virtual machines simultaneously. The ability to cause repeated crashes can lead to extended downtime periods that significantly impact business operations, particularly in enterprise environments where virtualization platforms support critical applications and services. Furthermore, the unauthorized update, insert, or delete access capabilities allow attackers to modify virtual machine configurations, potentially creating backdoors or compromising the integrity of the entire virtualized infrastructure.
Mitigation strategies should focus on implementing strict access controls for the underlying infrastructure where VirtualBox operates, ensuring that only authorized personnel have physical or remote access to these systems. Organizations must enforce the principle of least privilege for VirtualBox administration functions and implement comprehensive monitoring for unusual activity patterns that might indicate exploitation attempts. Network segmentation and firewall rules should be configured to limit access to VirtualBox management interfaces, while regular security assessments should validate that system configurations remain secure against known attack vectors. Patch management procedures must be established to ensure prompt deployment of vendor security updates when available, though this particular vulnerability appears to affect a specific version requiring immediate attention from affected organizations. According to CWE guidelines, this vulnerability likely maps to CWE-284 (Improper Access Control) and CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), while ATT&CK framework considerations suggest potential T1059 (Command and Scripting Interpreter) and T1499 (Endpoint Denial of Service) techniques may be employed by attackers exploiting this flaw.