Oracle VM VirtualBox CVE-2026-60150

Exploitation requires a local logon to the host where Oracle VM VirtualBox executes and a low-privileged account (CVSS PR:L), with no user interaction needed (UI:N) and low attack complexity (AC:L). The exact affected build is Oracle VM VirtualBox 7.2.12 running the Core component. Limiting factors: the attack vector is Local (AV:L), so there is no network-based or unauthenticated path - the attacker must first obtain interactive/authenticated access to the host, which meaningfully constrains realistic exploitation to insiders or attackers who have already established a foothold. No non-default feature toggle is named in the description as a prerequisite; the condition is simply an authenticated local presence on a host running the affected VirtualBox version.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - local attack vector, low complexity, low privileges required, no user interaction, and high impact across all three security properties. This is a genuine but access-gated risk: the attacker must already have a foothold (a local, low-privileged account) on the host, so it is not remotely or unauthenticated exploitable and is unlikely to be mass-exploited. No EPSS score, SSVC decision, KEV entry, or POC was provided; there is no public exploit identified at time of analysis and no evidence of active exploitation. One inconsistency to verify: the vendor Tags label this 'Information Disclosure', yet the CVSS reports full Integrity and Availability impact and the description states 'takeover' - the tag understates the assessed impact, so treat the C/I/A takeover framing (not merely disclosure) as authoritative. Overall this is a solid patch-in-normal-cycle priority (a strong local privilege-escalation/host-takeover primitive) rather than an emergency internet-facing threat.

An attacker who already holds a low-privileged local account on a workstation or server running Oracle VM VirtualBox 7.2.12 invokes a crafted interaction against the vulnerable Core component to escalate their control and take over the VirtualBox environment, gaining high-impact access to its data and operations. Because the CVSS complexity is low and no user interaction is needed, the local step is straightforward once access is obtained; no public POC is currently available. This would typically be chained after an initial foothold (phishing, stolen credentials, or a low-privilege service) to move toward host or hypervisor compromise.