Oracle VM VirtualBox CVE-2026-60159

Exploitation requires the attacker to already have high-privileged (PR:H) local logon (AV:L) on the infrastructure where Oracle VM VirtualBox 7.2.12 executes - i.e., an authenticated, privileged user or process on the virtualization host, not a remote or unauthenticated actor. It targets the VirtualBox Core component, and success triggers a scope change (S:C) that extends impact to the host beyond VirtualBox. Limiting factors: high attack complexity (AC:H) means the attacker must satisfy additional conditions such as winning a race or achieving a specific hypervisor state; no user interaction is needed (UI:N). These constraints make opportunistic exploitation unlikely and confine realistic risk to environments where privileged local users are untrusted (multi-tenant, shared labs, hostile insiders).

The signals are mixed and point to a serious-but-hard-to-trigger issue rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) requires local access, high attack complexity, and high privileges, which sharply limits the attacker population - but the scope change plus full C/I/A impact means a successful attack yields complete host/hypervisor takeover, which is why Oracle scores it 7.5. No EPSS score, KEV listing, or POC was provided; per the rules this is 'no public exploit identified at time of analysis,' and it is not confirmed actively exploited. The 'Information Disclosure' tag in the intelligence conflicts somewhat with the description's emphasis on full takeover (C:H/I:H/A:H) - treat the tag as loose categorization and rely on the CVSS impact metrics. Bottom line: a genuine high-severity hypervisor escape worth patching in the next Oracle CPU cycle, but the PR:H/AC:H profile makes opportunistic, widespread exploitation unlikely; risk is highest in multi-tenant or shared-lab environments where a privileged local user is untrusted relative to the host.

A malicious or compromised administrator/operator who already has high-privileged local logon on a shared VirtualBox host runs a specially crafted sequence against the Core virtualization layer, escaping the intended boundary to seize control of the host and any other guests it runs. Because attack complexity is high (AC:H), the attacker must win specific timing or state conditions, so this is a targeted, skilled-operator scenario rather than a point-and-click exploit. No public POC was provided in the intelligence.