CVE-2026-60160: 
VirtualBox vulnerability analysis and mitigation

CVE-2026-60160 is a memory disclosure vulnerability in the Core component of Oracle VM VirtualBox, affecting version 7.2.12. Disclosed as part of Oracle's Critical Patch Update (CPU) on July 21, 2026, it allows a high-privileged local attacker to gain unauthorized read access to a subset of VirtualBox-accessible data. The vulnerability carries a CVSS v3.1 base score of 3.2 (Low severity), with a scope change indicating potential impact on additional products beyond VirtualBox itself (Oracle CPU July 2026).

The vulnerability resides in the Core component of Oracle VM VirtualBox and is classified as a memory disclosure (information exposure) issue. Exploitation requires local logon access to the infrastructure where VirtualBox executes, along with high privileges — meaning an attacker must already have administrative or elevated access to the host system. The scope change in the CVSS vector (S:C) indicates that a successful attack can affect resources beyond the VirtualBox process itself, potentially exposing data from other components or guest environments. The vulnerability was reported by researcher "Hhy" to Oracle (Oracle CPU July 2026).

Successful exploitation results in unauthorized read access to a subset of data accessible to Oracle VM VirtualBox, impacting confidentiality only — there is no integrity or availability impact. Due to the scope change, the data exposure may extend beyond the VirtualBox process to affect additional products or components running on the same infrastructure. The attack is limited to local access by a high-privileged attacker, significantly constraining the practical blast radius (Oracle CPU July 2026).

Oracle has released a patch for this vulnerability as part of the July 2026 Critical Patch Update. Affected users running Oracle VM VirtualBox 7.2.12 should apply the available patch immediately via the Oracle CPU. As a temporary measure, restricting local logon access to systems running VirtualBox to only authorized administrators can reduce risk. Oracle strongly recommends against relying on workarounds as a long-term solution and advises upgrading to a patched version as soon as possible (Oracle CPU July 2026).