CVE-2026-60158: 
VirtualBox vulnerability analysis and mitigation

CVE-2026-60158 is an elevation of privilege vulnerability in the Core component of Oracle VM VirtualBox, affecting version 7.2.12. It was disclosed on July 21, 2026, as part of Oracle's July 2026 Critical Patch Update (CPU). The vulnerability allows a low-privileged local attacker to compromise VirtualBox with a scope change that may impact additional products beyond VirtualBox itself. It carries a CVSS v3.1 base score of 6.4 (Medium) (Oracle CPU Jul 2026).

The vulnerability resides in the Core component of Oracle VM VirtualBox and is classified as an elevation of privilege issue. Exploitation requires local logon access to the infrastructure where VirtualBox executes, low privileges, and no user interaction, but is rated as difficult to exploit (high attack complexity). The scope change indicator (S:C) means a successful attack can affect resources beyond the VirtualBox security boundary, potentially impacting the host or other guest VMs. The vulnerability was reported to Oracle by the researcher identified as "Vmpr0be" (Oracle CPU Jul 2026).

Successful exploitation allows an attacker to perform unauthorized creation, deletion, or modification of critical data accessible to Oracle VM VirtualBox, as well as cause a partial denial of service of the VirtualBox service. Confidentiality is not impacted, but integrity is rated High and availability is rated Low. Due to the scope change, the impact may extend beyond the VirtualBox process itself to affect additional products or resources on the host system (Oracle CPU Jul 2026).

Oracle has released a patch for this vulnerability as part of the July 2026 Critical Patch Update. Users should upgrade Oracle VM VirtualBox to a version beyond 7.2.12 that incorporates the CPU patch. As an interim measure, restrict local logon access to systems running VirtualBox to trusted and authorized users only, and implement additional access controls on the infrastructure where VirtualBox executes. Oracle strongly recommends applying CPU patches as soon as possible rather than relying on workarounds (Oracle CPU Jul 2026).