CVE-2026-60158: Oracle VM VirtualBox Privilege Escalation

CVE-2026-60158 Overview

CVE-2026-60158 is an improper access control vulnerability [CWE-284] in the Core component of Oracle VM VirtualBox, part of Oracle Virtualization. The affected supported version is 7.2.12. A low-privileged attacker with local logon to the infrastructure running Oracle VM VirtualBox can exploit this flaw, though exploitation is rated difficult. Successful exploitation permits unauthorized creation, deletion, or modification of critical data accessible to Oracle VM VirtualBox and can trigger a partial denial of service. The vulnerability carries a scope change, meaning impact can extend beyond VirtualBox to other products on the host.

Critical Impact
Local attackers with low privileges can compromise integrity of VirtualBox-accessible data and cause partial denial of service, with impact crossing security boundaries to affect additional host components.

Affected Products

Oracle VM VirtualBox 7.2.12
Oracle Virtualization (Core component)

Discovery Timeline

2026-07-21 - CVE-2026-60158 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60158

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle VM VirtualBox and is classified as improper access control [CWE-284]. Oracle documents the flaw as difficult to exploit, requiring local logon to the host infrastructure and low privileges on that host. The scope change indicated by Oracle's advisory means the vulnerable component and the impacted component are not the same security authority. This behavior is characteristic of hypervisor boundary issues, where a compromise inside one context reaches resources belonging to another.

Successful exploitation grants unauthorized create, delete, or modify access to critical data or all VirtualBox-accessible data. Attackers can also induce a partial denial of service on the VirtualBox service. Confidentiality impact is rated none, but integrity impact is high and availability impact is low. The EPSS probability for this CVE is 0.093% at the 68.8 percentile as of 2026-07-23.

Root Cause

Oracle has not published low-level technical details for the flaw. The [CWE-284] classification indicates that a subject can perform an action on a resource without adequate authorization checks. The scope change suggests a control that should isolate the guest, host, or an auxiliary service is bypassed during a specific Core operation.

Attack Vector

The attack vector is local. An adversary must first obtain a valid low-privileged session on the host where Oracle VM VirtualBox runs. From that foothold, the attacker interacts with the vulnerable Core code path to alter data or degrade the service. High attack complexity indicates the attacker must satisfy specific conditions outside their control, such as timing, configuration state, or race windows.

No public proof-of-concept, ExploitDB entry, or CISA KEV listing exists for CVE-2026-60158 at the time of publication. Refer to the Oracle Security Alert July 2026 for vendor-provided technical guidance.

Detection Methods for CVE-2026-60158

Indicators of Compromise

Unexpected creation, deletion, or modification of VirtualBox configuration files, VM disk images (.vdi, .vmdk), or the VirtualBox.xml inventory on the host.
VirtualBox service (VBoxSVC, VBoxHeadless) crashes, restarts, or hangs correlated with local user sessions.
Local logons by low-privileged accounts followed by unusual VBoxManage invocations or direct file access to VirtualBox data directories.

Detection Strategies

Baseline the running version of Oracle VM VirtualBox across the fleet and flag hosts still on 7.2.12.
Monitor for anomalous child processes spawned by the VirtualBox service and for API calls affecting VM state outside of change windows.
Correlate local authentication events with subsequent modifications to VM storage or configuration to surface abuse by low-privileged users.

Monitoring Recommendations

Enable auditing on VirtualBox installation and VM storage directories to record write and delete operations.
Forward VirtualBox host logs and OS audit logs to a central SIEM or data lake for cross-source correlation.
Alert on service crash events for VBoxSVC and repeated restarts that could indicate partial denial-of-service attempts.

How to Mitigate CVE-2026-60158

Immediate Actions Required

Apply the fixes published in the Oracle Critical Patch Update - July 2026 to any host running Oracle VM VirtualBox 7.2.12.
Inventory all VirtualBox installations and prioritize multi-tenant or shared hosts for patching.
Restrict interactive logon on VirtualBox hosts to trusted administrators only.

Patch Information

Oracle addresses this vulnerability in the July 2026 Critical Patch Update. Administrators should download the updated Oracle VM VirtualBox release referenced in the advisory and replace version 7.2.12 on affected hosts. Verify the installed version with VBoxManage --version after patching.

Workarounds

Remove local logon rights for non-administrative users on hosts that run Oracle VM VirtualBox until patches are applied.
Enforce least privilege on directories containing VM disks and configuration files to limit modification paths.
Isolate VirtualBox hosts on dedicated systems where untrusted users cannot obtain a local session.

bash

# Verify installed VirtualBox version and restrict local logon (Linux example)
VBoxManage --version
# Remove a low-privileged user from local logon on the VirtualBox host
sudo gpasswd -d <username> vboxusers
# Tighten permissions on VirtualBox data directory
sudo chmod 750 /home/<vbox-admin>/VirtualBox\ VMs