Oracle VM VirtualBox CVE-2026-60160

Exploitation requires a high-privileged attacker (PR:H per CVSS) with local logon access to the infrastructure host running Oracle VM VirtualBox 7.2.12 - this is not a remote attack and cannot be triggered over a network. The attacker must hold an OS-level administrative or equivalent high-privilege account on the physical or virtual host. No user interaction is required once the attacker has the necessary access. Exploitation impact is limited strictly to confidentiality (reading a partial subset of VirtualBox-accessible data); no write, delete, or service disruption capability is available through this vector. Limiting factors: local-only access, requirement for pre-existing high-privilege account, no availability or integrity impact, and no remote triggering path - all of which significantly reduce realistic risk beyond the raw CVSS scope-change flag.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) scores 3.2 - Low - and accurately reflects a tightly constrained attack surface. The local attack vector (AV:L) eliminates remote exploitation entirely; the high-privilege requirement (PR:H) restricts the attacker population to administrators or hypervisor operators with an existing foothold on the host. The scope change (S:C) is the most noteworthy signal, suggesting cross-VM data leakage is theoretically possible, but it is bounded by the C:L (Low) confidentiality rating, meaning only a partial, unspecified subset of data is reachable. No EPSS score was provided in the intelligence data, and the vulnerability does not appear in the CISA KEV catalog, confirming no confirmed active exploitation. The 'Authentication Bypass' tag conflicts with PR:H - this discrepancy is unresolved from available data and should be verified with Oracle's advisory. Overall, this is a low-real-risk finding: high CVSS scope change flags add academic interest but do not elevate operational priority given the access prerequisites.

A system administrator or privileged operator with an existing high-privilege local session on a VirtualBox 7.2.12 host exploits the Core component flaw to read a subset of VirtualBox-managed data - potentially including memory regions or configuration data belonging to hosted guest VMs. Because the scope change flag is set, the read access may cross VM isolation boundaries, giving the attacker partial visibility into guest data they would not normally be able to access from the host OS. No public exploit code has been identified at the time of this analysis.