CVE-2026-60170 in Hospitality Simphony
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Hospitality Simphony, a comprehensive point of sale and restaurant management system widely deployed in the food and beverage industry. The affected component is the POS (Point of Sale) module which serves as the primary interface for transaction processing and customer data management. The vulnerability affects specific version ranges including 19.8 through 19.8.5, 19.9 through 19.9.3, and 19.10, representing a significant portion of the product's release cycle. These versions contain a critical flaw that exposes sensitive data processing capabilities to unauthorized access without requiring authentication credentials.
The technical nature of this vulnerability stems from insufficient authentication mechanisms within the HTTP communication layer of the POS system. An attacker positioned on the network can exploit this weakness by simply sending crafted HTTP requests to the affected Oracle Hospitality Simphony instances. This unauthenticated access pathway represents a fundamental breakdown in the security architecture that violates standard security principles established by frameworks such as CWE-305 (Authentication Bypass Using an Alternate Path or Channel) and CWE-287 (Improper Authentication). The vulnerability's ease of exploitation is highlighted by its CVSS 3.1 base score of 7.5, indicating high severity with low attack complexity and no requirement for user interaction.
The operational impact of this vulnerability extends beyond simple data exposure, potentially enabling complete compromise of sensitive customer information stored within the system. Attackers could gain unauthorized access to critical data including customer payment details, transaction histories, personal identification information, and other confidential business data. This represents a significant risk to both customer privacy and organizational security posture. The confidentiality impact is rated as high (C:H) in the CVSS vector, indicating that successful exploitation could result in substantial data loss or disclosure. Organizations using this software may face regulatory compliance violations under data protection frameworks such as GDPR, PCI DSS, and other industry standards that mandate proper authentication and access controls.
Mitigation strategies should prioritize immediate patching of affected systems to address the underlying authentication flaw in the POS component. Network segmentation should be implemented to limit direct exposure of the Oracle Hospitality Simphony instances to untrusted networks, while additional monitoring should be deployed to detect anomalous HTTP traffic patterns that might indicate exploitation attempts. Organizations should also conduct comprehensive security assessments of their hospitality infrastructure to identify other potential vulnerabilities in related systems and ensure proper access controls are implemented across all components. The vulnerability's classification under ATT&CK technique T1071.004 (Application Layer Protocol: DNS) and T1190 (Exploit Public-Facing Application) indicates that traditional network security measures may be insufficient alone, requiring layered defensive approaches including application firewalls, intrusion detection systems, and regular security audits to maintain adequate protection against such threats.