Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVE-2026-60162)

CVE-2026-60162 is a vulnerability in Oracle VM VirtualBox's core component that affects multiple specific versions including 7.2.12. It allows a high privileged attacker with local logon access to compromise the VirtualBox environment, potentially gaining unauthorized access to critical data and causing a partial denial of service. The vulnerability has a CVSS 3.1 score of 6.1 with attack vector local, high attack complexity, and no user interaction required. The scope is changed, meaning the impact extends beyond the immediate component. The vulnerability impacts confidentiality (high) and availability (low) but not integrity.

Successful exploitation can lead to unauthorized access to critical data within Oracle VM VirtualBox and partial denial of service conditions. The attacker must have high privileges and local access to the infrastructure running VirtualBox. There is no reported impact on data integrity. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Oracle's advisories for updates. Given the high privilege requirement and local access needed, limiting access to the infrastructure and applying principle of least privilege may reduce risk until a fix is available.