Oracle VirtualBox CVE-2026-60155

Exploitation requires the attacker to already have a local logon to the host where VirtualBox executes AND to already hold high privileges on that host (PR:H, AV:L) - this is not remotely reachable and not usable by an unprivileged user. It further requires overcoming high attack complexity (AC:H), implying a non-trivial condition such as winning a race, satisfying specific memory/state preconditions, or a particular guest/host configuration in the Core component. What limits exploitation: no network vector, no unauthenticated path, and no user interaction is involved, but the dual requirement of local access plus pre-existing high privilege sharply narrows the realistic attacker set to insiders or attackers who have already fully compromised a privileged host account. The specific configuration triggering AC:H is not detailed in the description and should be confirmed against the Oracle CPU advisory.

The signals point to a serious-but-hard-to-reach issue rather than a mass-exploitation emergency. The CVSS 3.1 base score is 7.5 (High), but the vector AV:L/AC:H/PR:H is deliberately constraining: the attacker must already have local logon access to the host AND already hold high privileges AND overcome high attack complexity. The offsetting factor that keeps the score high is S:C with C:H/I:H/A:H - successful exploitation escapes the VirtualBox boundary and can compromise the host or adjacent products. No EPSS score, KEV listing, or POC was provided, and no SSVC decision data is available, so there is no evidence of active or automatable exploitation; realistically this is a defense-in-depth patch priority, not a fire-drill. One caveat to verify with the vendor: Oracle tags the CVE as 'Information Disclosure', which is narrower than the full C:H/I:H/A:H 'takeover' impact described - the vector and prose should be treated as authoritative over the tag.

An attacker who has already gained a high-privileged local account on a workstation or server running VirtualBox 7.2.12 chains a complex sequence against the Core virtualization component to break out of the hypervisor's boundary. Because of the scope change, the resulting takeover extends beyond VirtualBox to the host system or adjacent products, giving full read/write/destroy control. No public POC is known, and the high attack complexity means this is a targeted, skilled-operator scenario rather than a point-and-click exploit.