What is the CVSS score of CVE-2026-60159?

CVE-2026-60159 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle VM VirtualBox are affected by CVE-2026-60159?

Oracle VM VirtualBox 7.2.12 contains a critical hypervisor escape vulnerability (CVE-2026-60159, CVSS 7.5) that allows privileged local attackers to achieve full host system compromise with scope…

How to fix or mitigate CVE-2026-60159?

Within 24 hours, audit all systems running VirtualBox 7.2.12, classify by usage tier (production, development, lab), and identify any with elevated network exposure. Within 7 days, restrict administrative access to VirtualBox management console to essential personnel only, enable comprehensive audit logging of all hypervisor-level operations, and implement network segmentation isolating VirtualBox hosts from production systems. Within 30 days, monitor Oracle security bulletins and the CISA Known Exploited Vulnerabilities catalog for vendor-released patches to CVE-2026-60159, develop an upgrade strategy to VirtualBox 7.3.x or newer, and conduct threat detection scanning on affected systems for signs of exploitation.

Oracle VM VirtualBox CVE-2026-60159

EUVD-2026-46565 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-2364-94fc-6cr9

Authentication Bypass Oracle Oracle Vm Virtualbox Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Requires privileged local logon on the host (AV:L/PR:H) and difficult-to-meet trigger conditions (AC:H); a Core hypervisor escape changes scope (S:C) with full host C/I/A compromise.

3.1 AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:11 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full host takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a high-privileged local attacker who is already logged into the infrastructure running VirtualBox to compromise the hypervisor, with a scope change (CVSS S:C) indicating impact beyond VirtualBox itself - consistent with a guest-to-host or component-crossing escape. Oracle rates it CVSS 3.1 7.5 with full confidentiality, integrity, and availability impact, though exploitation is difficult (AC:H, PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle VM VirtualBox is a type-2 (hosted) hypervisor that runs guest virtual machines on top of a host OS. The flaw is in the 'Core' component, the part of VirtualBox responsible for VM execution, device emulation, and the guest/host boundary. A scope-change (S:C) vulnerability in a hypervisor Core component is the classic signature of a VM escape, where code or actions confined to the virtualization layer break out to affect other security authorities (the host OS or other guests). No CWE was assigned in the source data, so the precise root-cause class (e.g., memory corruption in device emulation, improper input validation across the guest/host interface) cannot be confirmed from the provided intelligence; the CPE cpe:2.3:a:oracle_corporation:oracle_vm_virtualbox identifies the affected application, and the description explicitly names version 7.2.12 as the supported affected version.

RemediationAI

Apply the fix from the Oracle Critical Patch Update of July 2026 by upgrading Oracle VM VirtualBox to the patched maintenance release identified in that advisory (https://www.oracle.com/security-alerts/cpujul2026.html); the exact fixed version is published in the CPU matrix and should be taken from there rather than assumed. Patch available per vendor advisory (Oracle CPU July 2026). Until patching, reduce exposure by limiting who holds high-privilege local logon on hosts that run VirtualBox, since exploitation requires PR:H local access - avoid running untrusted or multi-tenant workloads on shared VirtualBox hosts, and where feasible power down or isolate sensitive guests. Restrict interactive access to virtualization hosts and monitor for unexpected privileged process activity; note these are access-restriction controls that do not close the underlying flaw and may reduce operational convenience, so patching remains the only complete remediation.