Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVE-2026-60159)

CVE-2026-60159 is a vulnerability in the Oracle VM VirtualBox core component affecting version 7.2.12 and many other specific versions. It allows a high privileged attacker with local logon to the infrastructure where VirtualBox runs to compromise the product, potentially resulting in full takeover. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.5 and vector AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. The scope of impact extends beyond VirtualBox to other products due to the nature of the compromise. Exploitation is difficult due to the requirement for high privileges and local access.

Successful exploitation can result in complete compromise of Oracle VM VirtualBox, impacting confidentiality, integrity, and availability. The vulnerability requires a high privileged attacker with local access, limiting the attack surface. The scope change indicates that additional products relying on VirtualBox may also be affected by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch or remediation information is provided, users should monitor Oracle's official advisories for updates. Given the high privilege and local access requirements, restricting access to the VirtualBox infrastructure and limiting high privileged user accounts can reduce risk until a fix is available.