What is the CVSS score of CVE-2026-60150?

CVE-2026-60150 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle VM VirtualBox are affected by CVE-2026-60150?

Oracle VM VirtualBox 7.2.12 contains a privilege escalation vulnerability (CVE-2026-60150) that could allow attackers with access to host systems to gain complete control of the virtualization…

How to fix or mitigate CVE-2026-60150?

Within 24 hours, identify and inventory all Oracle VM VirtualBox 7.2.12 deployments and audit which users have local host access. Within 7 days, implement operating system-level access controls to restrict local host access and deploy monitoring for local privilege escalation attempts. Within 30 days, assess migration options to alternative hypervisor platforms for non-critical systems and establish a readiness plan for vendor patches once Oracle releases a fix.

Oracle VM VirtualBox CVE-2026-60150

EUVD-2026-46557 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 oracle

GHSA-q99m-jxff-pvhm

Oracle Oracle Vm Virtualbox Privilege Escalation

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Requires an authenticated local low-privileged account (AV:L, PR:L) with no user interaction and low complexity, yielding full host-side VirtualBox takeover across confidentiality, integrity, and availability.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:12 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Local privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged attacker with a local logon on the host where VirtualBox executes to take over the VirtualBox installation, with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV; despite a vendor 'Information Disclosure' tag, the CVSS vector reports full C/I/A impact consistent with product takeover. Exploitation requires prior local access and low privileges, which limits mass exploitation but makes it valuable as a post-access escalation step.

Technical ContextAI

Oracle VM VirtualBox is a widely used type-2 hypervisor that runs guest virtual machines on top of a host OS, using kernel-level drivers and privileged host processes (the 'Core' component covers the central virtualization engine and its host-side services). The vulnerability resides in this Core component, meaning it involves the trusted host-side machinery that manages VM execution and mediates between low-privileged user processes and higher-privileged hypervisor operations. No CWE was assigned in the input, so the precise defect class (e.g., improper access control, memory corruption, or input validation in a host-facing interface) cannot be stated with certainty; the local attack vector combined with a scope-unchanged full-impact rating points to a flaw reachable by an authenticated local user that yields control over the VirtualBox process/service context.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update: Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html - consult that advisory for the exact patched VirtualBox build, as no specific fixed version number is provided in the input data (do not assume a version beyond what Oracle publishes). Until patched, reduce exposure by limiting who can obtain local interactive logon on hosts running VirtualBox, since exploitation requires a local low-privileged account: restrict host access to trusted administrators, remove unnecessary local user accounts and shared-host multi-tenancy, and avoid running VirtualBox on hosts that also serve as general-purpose multi-user login systems (trade-off: this constrains legitimate shared use of the host). Where feasible, shut down or isolate VirtualBox instances on high-exposure hosts until the CPU patch is deployed, accepting the availability impact to running VMs.