What is the CVSS score of CVE-2026-60155?

CVE-2026-60155 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle VirtualBox are affected by CVE-2026-60155?

Oracle VM VirtualBox 7.2.12 contains a privilege-escalation vulnerability that allows high-privileged local users with host access to compromise the hypervisor core component and extend impact to…

How to fix or mitigate CVE-2026-60155?

Within 24 hours, inventory all Oracle VirtualBox 7.2.12 Core installations and audit high-privileged local user accounts with host access; enable logging and monitoring for privilege-escalation detection. Within 7 days, restrict local host logon privileges to essential personnel through principle-of-least-privilege, implement privileged access management controls with multi-factor authentication, and increase monitoring for unusual administrative activity. Within 30 days, monitor Oracle security advisories for patch availability for CVE-2026-60155; prepare upgrade procedures for deployment when a patch is released, and evaluate hypervisor alternatives if patch timelines do not align with organizational risk requirements.

Oracle VirtualBox CVE-2026-60155

EUVD-2026-46561 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-fh87-4vw7-x6f9

Authentication Bypass Oracle Oracle Vm Virtualbox Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Local host access with pre-existing high privilege and a hard-to-meet Core precondition give AV:L/PR:H/AC:H; hypervisor escape justifies S:C with full C/I/A:H.

3.1 AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:12 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege-escalating host compromise in Oracle VM VirtualBox 7.2.12 (Core component) lets a high-privileged local attacker with a logon to the host take over the VirtualBox hypervisor and, because of a scope change, impact additional products beyond VirtualBox itself. The flaw carries full confidentiality, integrity, and availability impact but is rated difficult to exploit, requiring high privileges and high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle VM VirtualBox is a type-2 hypervisor that runs guest virtual machines on top of a host operating system; the affected 'Core' component handles the low-level virtualization/emulation layer that mediates between guest VMs and host resources. The CVSS scope-change flag (S:C) combined with the note that attacks 'may significantly impact additional products' is the classic signature of a virtualization boundary weakness - the security authority of the hypervisor process is crossed so that compromise reaches resources outside VirtualBox's own sandbox (typically the underlying host or other guests). No CWE was supplied, so the precise root-cause class (e.g., memory corruption, improper isolation, or input validation in an emulated device) cannot be confirmed from the available data; the affected CPE is cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox and Oracle tags the issue as Information Disclosure despite the vector recording full C/I/A impact.

RemediationAI

Apply the fix delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though an exact fixed build number is not stated in the provided data and should be taken directly from the CPU matrix (upgrade past the affected 7.2.12). Because exploitation requires an already-high-privileged local account, the strongest compensating control until patching is to tightly restrict who holds administrative/host logon rights on machines running VirtualBox and to avoid running the hypervisor on shared multi-user or internet-facing hosts (trade-off: reduces convenience for multi-admin lab environments). Where feasible, shut down or migrate untrusted guest VMs and limit which local accounts can start/manage VMs, since the scope-change impact reaches host resources; monitor host integrity and privileged-account activity as a detection layer while the patch window is open.