This vulnerability affects Oracle VM VirtualBox 7.2.12 and allows a high privileged attacker with local access (logon) to the host infrastructure where VirtualBox runs to compromise the VirtualBox environment. The attack can result in unauthorized read access to a subset of data accessible by Oracle VM VirtualBox. The CVSS 3.1 vector indicates local attack vector, low complexity, high privileges required, no user interaction, scope changed, and limited confidentiality impact (CWE-200). The vendor advisory does not explicitly confirm a patch or remediation for this specific issue but references the July 2026 Critical Patch Update which includes numerous patches across Oracle products. No known exploits in the wild are reported.

The impact is limited to unauthorized read access to some data accessible by Oracle VM VirtualBox, with no integrity or availability impact. The vulnerability requires high privileges and local access to the host system. Due to scope change, other Oracle products may be indirectly affected if they rely on or integrate with Oracle VM VirtualBox. The overall severity is low (CVSS 3.2).

The vendor advisory does not explicitly mention a dedicated patch or fix for CVE-2026-60160. Oracle recommends applying Critical Patch Updates promptly to address vulnerabilities. Since no specific patch or remediation level is stated, patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. No additional mitigation steps are provided by the vendor for this vulnerability.