CVE-2026-60162
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Vulnerability in Oracle VM VirtualBox (component: Core) affects version 7.2.12. A high-privileged attacker with local access can gain unauthorized access to critical data or all VirtualBox data and cause partial denial of service. Attacks may impact additional products (scope change). Exploitation is difficult.
Risk Assessment
Risk of data leakage from virtual machines and partial disruption of VirtualBox, potentially affecting other products.
Recommendation
Update Oracle VM VirtualBox to version 7.2.13 or later and restrict local access to the VirtualBox host.
Other vulnerabilities in Oracle VM VirtualBox
See all- CVE-2026-101599High
Vulnerability in Oracle VM VirtualBox (component: Core) affects version 7.2.20. A low-privileged attacker with logon to the infrastructure where VirtualBox executes can exploit this vulnerability, which requires user interaction, leading to takeover of VirtualBox and potentially impacting other products.
- CVE-2026-101598High
Vulnerability in Oracle VM VirtualBox (component: Core) affects version 7.2.20. A low-privileged attacker with logon to the infrastructure where VirtualBox executes can easily exploit this vulnerability, leading to takeover of VirtualBox.
- CVE-2026-21990High
A vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is easily exploitable by a high privileged attacker with logon to the infrastructure where VirtualBox executes. Successful attacks can result in takeover of VirtualBox, and may significantly impact additional products (scope change). CVSS 3.1 Base Score is 8.2.
- CVE-2026-21989High
A vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is easily exploitable by a high privileged attacker with logon to the infrastructure where VirtualBox executes. Successful attacks can result in unauthorized creation, deletion or modification of data, unauthorized access to data, and partial denial of service. CVSS 3.1 Base Score is 8.1.
- CVE-2026-21988High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, and the attack may impact other products (scope change).
- CVE-2026-21987High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, and the attack may impact other products (scope change).
- CVE-2026-21986High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An unauthenticated attacker with local access can cause a hang or frequently repeatable crash (complete DoS) of VirtualBox. This vulnerability applies to Windows VMs only.
- CVE-2026-21984High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, but exploitation is difficult. The attack may impact other products (scope change).
- CVE-2026-21983High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, but exploitation is difficult. The attack may impact other products (scope change).
- CVE-2026-21982High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An unauthenticated attacker with access to the physical communication segment attached to the hardware where VirtualBox executes can take over VirtualBox. Exploitation is difficult.
Original NVD description (English source)
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS