CVE-2026-60162: 
VirtualBox vulnerability analysis and mitigation

CVE-2026-60162 is a vulnerability in the Core component of Oracle VM VirtualBox affecting version 7.2.12, disclosed as part of Oracle's Critical Patch Update (CPU) for July 2026. It allows a high-privileged local attacker with logon access to the infrastructure to compromise VirtualBox, with a scope change indicating potential impact on additional products beyond VirtualBox itself. The vulnerability has a CVSS v3.1 base score of 6.1 (Medium) (Oracle Advisory). It was reported to Oracle by Xiaobye (xiaobye_tw) of DEVCORE Research Team working with TrendAI Zero Day Initiative (Oracle Advisory).

The vulnerability resides in the Core component of Oracle VM VirtualBox and requires high privileges and local access to exploit, with high attack complexity (CWE classification not explicitly published by Oracle). The attack vector is local, meaning the attacker must have logon access to the system running VirtualBox, and no user interaction is required. The scope change (S:C) in the CVSS vector indicates that a successful exploit can affect resources beyond the VirtualBox process itself, potentially impacting the host or other guest VMs. No technical write-ups or public proof-of-concept code have been identified at this time (Oracle Advisory).

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible to Oracle VM VirtualBox, as well as a partial denial of service (partial DOS) of the VirtualBox service. The confidentiality impact is rated High and availability impact is Low, with no integrity impact. The scope change means exploitation could significantly affect additional products or components beyond VirtualBox itself, raising the risk of cross-VM or host-level data exposure (Oracle Advisory).

Oracle has released a patch for this vulnerability as part of the July 2026 Critical Patch Update. Administrators should apply the CPU patch to Oracle VM VirtualBox 7.2.12 as soon as possible. As a temporary measure, Oracle recommends restricting local logon access to systems running VirtualBox to only trusted, high-privileged administrators. Oracle strongly advises against relying on workarounds as a long-term solution and recommends upgrading to a patched version (Oracle Advisory).