CVE-2026-60150
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Vulnerability in Oracle VM VirtualBox 7.2.12 allows a low-privileged local attacker to take over the virtual machine. The attack is easy to exploit and only requires logon to the system where VirtualBox runs.
Risk Assessment
A successful attack leads to full takeover of Oracle VM VirtualBox, potentially compromising confidentiality, integrity, and availability of data.
Recommendation
It is recommended to immediately update Oracle VM VirtualBox to the latest available version that includes the security fix.
Other vulnerabilities in Oracle VM VirtualBox
See all- CVE-2026-21990High
A vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is easily exploitable by a high privileged attacker with logon to the infrastructure where VirtualBox executes. Successful attacks can result in takeover of VirtualBox, and may significantly impact additional products (scope change). CVSS 3.1 Base Score is 8.2.
- CVE-2026-21989High
A vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is easily exploitable by a high privileged attacker with logon to the infrastructure where VirtualBox executes. Successful attacks can result in unauthorized creation, deletion or modification of data, unauthorized access to data, and partial denial of service. CVSS 3.1 Base Score is 8.1.
- CVE-2026-21988High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, and the attack may impact other products (scope change).
- CVE-2026-21987High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, and the attack may impact other products (scope change).
- CVE-2026-21986High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An unauthenticated attacker with local access can cause a hang or frequently repeatable crash (complete DoS) of VirtualBox. This vulnerability applies to Windows VMs only.
- CVE-2026-21984High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, but exploitation is difficult. The attack may impact other products (scope change).
- CVE-2026-21983High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. A high-privileged attacker with local access can take over VirtualBox, but exploitation is difficult. The attack may impact other products (scope change).
- CVE-2026-21982High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An unauthenticated attacker with access to the physical communication segment attached to the hardware where VirtualBox executes can take over VirtualBox. Exploitation is difficult.
- CVE-2026-21957High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. It is difficult to exploit, requires high-privileged local access, but can lead to full takeover of VirtualBox. Attacks may impact additional products (scope change).
- CVE-2026-21956High
Vulnerability in Oracle VM VirtualBox (component: Core) affects versions 7.1.14 and 7.2.4. An attacker with high privileges and local access to the infrastructure can easily exploit this flaw, potentially leading to takeover of Oracle VM VirtualBox. The vulnerability has a scope change, meaning attacks may also impact additional products.
Original NVD description (English source)
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).