CVE-2026-60159: Oracle VM VirtualBox Privilege Escalation

CVE-2026-60159 Overview

CVE-2026-60159 is a vulnerability in the Core component of Oracle VM VirtualBox, part of Oracle Virtualization. The affected supported version is 7.2.12. A high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes can exploit the flaw to compromise the hypervisor. Although the vulnerability resides in Oracle VM VirtualBox, successful exploitation produces a scope change and may significantly impact additional products on the host. The weakness is classified under [CWE-284] Improper Access Control. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation results in complete takeover of Oracle VM VirtualBox with high impact to confidentiality, integrity, and availability, and scope change to other host components.

Affected Products

Oracle VM VirtualBox 7.2.12
Oracle Virtualization (Core component)
Host systems running the affected VirtualBox release

Discovery Timeline

2026-07-21 - CVE-2026-60159 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60159

Vulnerability Analysis

The vulnerability affects the Core component of Oracle VM VirtualBox 7.2.12. Oracle classifies it under improper access control ([CWE-284]), which typically covers missing or incorrect enforcement of restrictions on privileged operations exposed to lower-trust contexts.

Exploitation requires local access to the infrastructure hosting VirtualBox and high pre-existing privileges. The high attack complexity indicates that additional conditions beyond attacker control must be satisfied for successful exploitation. Despite these preconditions, a successful attack yields full takeover of the VirtualBox instance.

The scope change is the notable characteristic. Because VirtualBox mediates between guest virtual machines and host resources, a compromise of the hypervisor extends impact beyond the vulnerable component into other host-side products and workloads.

Root Cause

The root cause is improper access control within the Core component of Oracle VM VirtualBox. Oracle has not publicly released implementation-level details. See the Oracle Security Alert July 2026 for vendor guidance.

Attack Vector

The attack vector is local. An attacker must already possess high privileges and interactive logon access on the host where Oracle VM VirtualBox runs. From that position, the attacker interacts with the vulnerable Core component to escalate control over the hypervisor and pivot into other products affected by the scope change. No user interaction is required. No public proof-of-concept or exploit code is available at this time.

Detection Methods for CVE-2026-60159

Indicators of Compromise

No public indicators of compromise have been published for CVE-2026-60159.
Review VirtualBox host logs for unexpected process launches, service restarts, or configuration changes originating from privileged local accounts.

Detection Strategies

Inventory hosts running Oracle VM VirtualBox 7.2.12 and confirm patch status against the July 2026 Oracle Critical Patch Update.
Monitor privileged account activity on virtualization hosts, focusing on logon events and process execution tied to VirtualBox binaries and services.
Correlate host-side telemetry with virtual machine lifecycle events to identify unauthorized hypervisor interactions.

Monitoring Recommendations

Enable audit logging for local logons and privilege use on all VirtualBox host systems.
Track integrity of VirtualBox installation directories, kernel drivers, and configuration files.
Alert on unexpected changes to VM configurations, snapshots, or shared folder mappings performed by non-administrative workflows.

How to Mitigate CVE-2026-60159

Immediate Actions Required

Apply the fixes from the Oracle Security Alert July 2026 to all affected Oracle VM VirtualBox 7.2.12 deployments.
Restrict interactive and remote logon on VirtualBox hosts to a minimal set of administrators.
Audit privileged group membership on hosts that run VirtualBox and remove unnecessary accounts.

Patch Information

Oracle addressed CVE-2026-60159 in the July 2026 Critical Patch Update. Administrators should upgrade Oracle VM VirtualBox beyond version 7.2.12 per vendor instructions in the Oracle Security Alert July 2026.

Workarounds

Limit local logon to VirtualBox hosts to trusted administrators only until patching is complete.
Enforce multi-factor authentication and session monitoring for privileged accounts on virtualization infrastructure.
Isolate VirtualBox hosts on management networks segmented from general user access.

bash

# Configuration example
# Verify installed Oracle VM VirtualBox version on the host
VBoxManage --version

# List local administrators (Linux example) to audit privileged access
getent group sudo vboxusers