Oracle VM VirtualBox CVE-2026-60162

Exploitation requires the attacker to have a high-privilege account with local logon capability to the physical or virtual infrastructure where Oracle VM VirtualBox 7.2.12 executes - this is explicitly confirmed by the CVSS metrics AV:L and PR:H. The attack complexity is rated High (AC:H), meaning additional non-default conditions or race conditions must be met beyond mere access; Oracle's CPU language 'difficult to exploit' reinforces this. No user interaction is required (UI:N) once access and complexity conditions are satisfied. Exploitation is bounded by: (1) requirement for local infrastructure access - remote network exploitation is not possible per AV:L; (2) high privilege prerequisite - standard user accounts are insufficient; (3) the AC:H barrier, which implies specific timing, configuration states, or environmental conditions not fully disclosed by Oracle. The scope change (S:C) means that while initial access is local and privileged, successful exploitation may reach beyond VirtualBox's security domain to adjacent systems.

The CVSS 3.1 base score of 6.1 reflects several mitigating factors: AV:L restricts the attack surface to adversaries with local logon access to the VirtualBox host, AC:H signals that meeting exploitation preconditions is non-trivial, and PR:H means the attacker must already hold elevated privileges. These three compounding prerequisites significantly limit the realistic threat population. However, S:C (scope change) is the critical risk amplifier - it indicates that a successful attacker can affect systems or data outside the VirtualBox security domain, which in hypervisor contexts typically implies host OS impact or lateral reach to co-hosted guest VMs. The confidentiality impact is rated High with no integrity impact and only partial availability impact, making data exfiltration the primary concern. EPSS data was not provided in the input, so exploitation probability cannot be quantified from that signal. No KEV listing and no POC are confirmed, indicating no observed active exploitation. The net assessment: this is a medium-severity, low-urgency issue for most environments due to the stringent local high-privilege prerequisite, but it warrants prioritized patching in shared virtualization infrastructure (cloud, VDI, lab environments) where the scope change could expose sensitive co-tenant data.

An attacker who has already obtained high-privileged access to a VirtualBox host - through credential theft, insider threat, or lateral movement - navigates a complex set of exploitation conditions within the Core component, potentially bypassing an internal VirtualBox access control mechanism. The attacker leverages the scope change to read confidential data from VirtualBox-accessible storage, including guest VM disk data or host-resident configuration secrets, and may also trigger a partial disruption of VirtualBox services. No public proof-of-concept code is confirmed, meaning successful exploitation currently requires significant attacker-side expertise to identify and meet the AC:H preconditions.