CVE-2026-60168 in Hospitality Simphony
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Simphony accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Simphony. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability under discussion represents a critical security flaw within Oracle Hospitality Simphony, specifically affecting the Point of Sale component of Oracle Food and Beverage Applications. This weakness exists in multiple version ranges including 19.8 through 19.8.5, 19.9 through 19.9.3, and 19.10, indicating a widespread issue that impacts several releases of the hospitality management platform. The vulnerability's classification as easily exploitable means that malicious actors require minimal technical expertise or resources to leverage this weakness effectively.
The technical nature of this flaw lies in the insufficient authentication and authorization mechanisms within the HTTP interface of the Simphony POS system. As an unauthenticated attack vector, it allows remote adversaries to access critical system functions without requiring valid credentials or prior access privileges. This represents a fundamental breakdown in the security architecture where network-level access through standard HTTP protocols can directly translate into system compromise. The CVSS 3.1 scoring of 9.1 reflects the severity of impact across both integrity and availability dimensions, with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H indicating network-based exploitation with low attack complexity, no privileges required, no user interaction needed, and universal scope.
The operational impact of this vulnerability extends beyond simple data compromise to include complete system denial of service capabilities. Attackers can not only modify or delete critical business data but also cause repeated system crashes or complete hangs that render the entire Simphony platform unusable. This dual threat affects both data integrity and system availability, potentially disrupting entire restaurant or hospitality operations during critical business periods. The ability to perform unauthorized data modifications without detection represents a significant risk for financial transaction records, inventory management data, and customer information stored within the system.
From a cybersecurity framework perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and maps to ATT&CK technique T1078 (Valid Accounts) and T1499 (Endpoint Denial of Service) through its combination of unauthorized access and system disruption capabilities. Organizations operating affected versions should implement immediate mitigations including network segmentation, firewall rule enforcement to restrict HTTP access, and deployment of intrusion detection systems to monitor for exploitation attempts. The vulnerability's severity warrants urgent patch management processes and consideration of temporary workarounds until official security updates are deployed. Additionally, comprehensive monitoring should be implemented to detect any unauthorized modifications to critical data elements or unusual system crash patterns that might indicate exploitation attempts.