Unauthorized Data Access Vulnerability in Oracle Hospitality Simphony
CVE-2026-60170

7.5HIGH

Key Information:

Vendor

Oracle
Status
Oracle Hospitality Simphony
Vendor
CVE Published:
21 July 2026

What is CVE-2026-60170?

This vulnerability affects the Oracle Hospitality Simphony POS system, allowing an unauthenticated attacker with network access via HTTP to potentially compromise the system. Exploitation could enable unauthorized access to sensitive information and complete control over accessible data, posing significant risks to organizations relying on this platform for transaction handling and customer interactions. It is crucial for users to implement necessary security measures and updates to mitigate this risk.

Affected Version(s)

Oracle Hospitality Simphony 19.8 <= 19.8.5

Oracle Hospitality Simphony 19.9 <= 19.9.3

Oracle Hospitality Simphony 19.10

References

https://www.oracle.com/security-alerts/cpujul2026.html
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.