CVE-2026-60159 is a vulnerability in the core component of Oracle VM VirtualBox version 7.2.12. It requires an attacker to have high privileges and logon access to the infrastructure where Oracle VM VirtualBox runs. The vulnerability allows the attacker to compromise Oracle VM VirtualBox, potentially leading to full takeover of the virtualization product. The vulnerability has a CVSS 3.1 score of 7.5 with a vector indicating local attack vector, high attack complexity, high privileges required, no user interaction, and a scope change affecting confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a fix or remediation level for this vulnerability in the provided excerpt. The vulnerability is classified under CWE-284 (Improper Access Control).

Successful exploitation of this vulnerability can result in complete compromise of Oracle VM VirtualBox, including full takeover of the virtualization environment. This can lead to significant confidentiality, integrity, and availability impacts within the affected infrastructure. Additionally, due to scope change, other products relying on Oracle VM VirtualBox may also be impacted. The vulnerability requires high privileges and local access, making exploitation more difficult but still impactful if achieved.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle's July 2026 Critical Patch Update advisory lists many patches but does not explicitly confirm a patch for Oracle VM VirtualBox 7.2.12 in the provided content. It is strongly recommended to monitor Oracle's official security alerts and apply any available patches promptly once confirmed. Until a patch is applied, restrict access to the infrastructure hosting Oracle VM VirtualBox to trusted, high-privileged users only to reduce risk.