This vulnerability affects the Core component of Oracle VM VirtualBox version 7.2.12. It permits a low privileged attacker who has logon access to the infrastructure where Oracle VM VirtualBox runs to compromise the VirtualBox software itself. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The attack vector requires local access with low privileges and no user interaction. The vulnerability is categorized under CWE-269 (Improper Privilege Management). Oracle has published a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities, including this one, but no explicit patch or remediation level is stated for this specific CVE in the advisory content provided.

Exploitation of this vulnerability can result in complete takeover of Oracle VM VirtualBox, allowing an attacker to gain unauthorized control over the virtualization environment. This compromises confidentiality, integrity, and availability of the affected system. The attack requires local access with low privileges, making it a significant risk in environments where multiple users have logon access.

Oracle has released a Critical Patch Update in July 2026 that addresses numerous vulnerabilities across its product portfolio. However, the vendor advisory does not explicitly confirm the availability of a patch or fix for CVE-2026-60150. Customers are strongly advised to review the July 2026 Critical Patch Update advisory and apply all relevant patches promptly. Until a specific patch is confirmed, monitor Oracle's official security alerts for updates. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.