CVE-2026-60161 Overview
CVE-2026-60161 affects the Core component of Oracle VM VirtualBox version 7.2.12. The flaw allows an unauthenticated attacker with local logon access to the host running VirtualBox to compromise the hypervisor. Exploitation requires human interaction from a user other than the attacker.
Successful exploitation causes a hang or repeatable crash (complete denial of service) of Oracle VM VirtualBox. Attackers can also gain unauthorized update, insert, or delete access to a subset of VirtualBox data. The underlying weakness is a race condition ([CWE-362]).
Critical Impact
Local attackers can trigger a complete VirtualBox crash and tamper with accessible virtualization data, disrupting hosted virtual machine workloads.
Affected Products
- Oracle VM VirtualBox version 7.2.12
- Oracle Virtualization (Core component)
- Host systems running the affected VirtualBox release
Discovery Timeline
- 2026-07-21 - CVE-2026-60161 published to the National Vulnerability Database
- 2026-07-23 - Last updated in NVD database
- July 2026 - Addressed in the Oracle Critical Patch Update July 2026
Technical Details for CVE-2026-60161
Vulnerability Analysis
The vulnerability resides in the Core component of Oracle VM VirtualBox 7.2.12. It is classified as a race condition ([CWE-362]), where concurrent execution of code paths without proper synchronization creates an exploitable window. An attacker with a local logon session on the host can influence timing to reach an inconsistent state within VirtualBox.
Because the attack requires user interaction from a party other than the attacker, exploitation typically depends on tricking a legitimate operator into performing an action that triggers the race. The result is a hang or reliably reproducible crash of the VirtualBox process, terminating running virtual machines. The flaw also permits limited unauthorized modification of data accessible to VirtualBox.
The EPSS probability of exploitation stands at roughly 0.14%, reflecting the local attack requirement and dependency on user interaction. However, in shared workstation and lab environments where multiple users share a VirtualBox host, the practical risk is higher.
Root Cause
The root cause is improper synchronization of shared resources within the Core component. Race conditions of this type occur when two or more code paths access shared state without adequate locking, creating a time-of-check to time-of-use ([TOCTOU]) or atomicity violation that leaves the process in an inconsistent state.
Attack Vector
The attack vector is local. An attacker requires an interactive session on the host running VirtualBox. The attacker then induces a second user to perform an action that races against the attacker-controlled code path, resulting in denial of service and limited data tampering. Refer to the Oracle Critical Patch Update July 2026 advisory for vendor-supplied technical context.
Detection Methods for CVE-2026-60161
Indicators of Compromise
- Repeated unexpected crashes or hangs of VirtualBox.exe, VBoxHeadless, or VBoxSVC processes on hosts running version 7.2.12.
- Unexplained modifications to VirtualBox configuration files, VM metadata, or .vbox machine descriptor files.
- Local user sessions coinciding with VirtualBox process termination or VM state corruption.
Detection Strategies
- Monitor host telemetry for abnormal termination of VirtualBox binaries and correlate with concurrent local logon activity.
- Inspect audit logs for unauthorized writes to VirtualBox configuration directories such as ~/.config/VirtualBox or %USERPROFILE%\.VirtualBox.
- Track process creation events that spawn VirtualBox utilities from unexpected user contexts on multi-user hosts.
Monitoring Recommendations
- Ingest host process and file integrity events into a centralized data lake for correlation across VirtualBox hosts.
- Alert on repeated crash signatures of VirtualBox core processes within short time windows.
- Baseline normal VirtualBox operator activity and flag deviations, especially on shared workstations.
How to Mitigate CVE-2026-60161
Immediate Actions Required
- Apply the fixes from the Oracle Critical Patch Update July 2026 to all hosts running Oracle VM VirtualBox 7.2.12.
- Restrict local logon rights on VirtualBox hosts to trusted administrators and operators only.
- Educate operators about social engineering vectors that could trigger the race condition through unsolicited actions.
Patch Information
Oracle addressed CVE-2026-60161 in the July 2026 Critical Patch Update. Administrators should upgrade Oracle VM VirtualBox beyond version 7.2.12 to the fixed release identified in the Oracle advisory.
Workarounds
- Limit interactive access to VirtualBox hosts to a single trusted user where feasible, eliminating the second-user interaction required for exploitation.
- Isolate VirtualBox hosts from general-purpose workstations to reduce multi-user exposure.
- Enforce least privilege on accounts that can start or manage VirtualBox virtual machines.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
