Oracle Hospitality Simphony CVE-2026-60167

The affected system must be running Oracle Hospitality Simphony POS at version 19.8-19.8.5, 19.9-19.9.3, or 19.10 with its HTTP interface reachable by the attacker over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond network reach - remote unauthenticated exploitation works against affected versions with no authentication, no user interaction, and no described non-default configuration. The primary limiting factor is network reachability of the POS HTTP endpoint: deployments where the interface is confined to an isolated store/management network and not Internet-exposed substantially reduce realistic exposure, and only the enumerated version ranges are affected.

The signals point to a genuine, easily exploitable disclosure issue rather than an inflated high-CVSS score. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N is the maximally exposed configuration for an attacker - network-reachable, low complexity, no authentication, no user interaction - and Oracle's own text calls it 'easily exploitable.' The scope is unchanged (S:U) and impact is confidentiality-only (C:H, I:N, A:N), which caps the base score at 7.5 (High) despite the ease of attack; there is no path to modification or disruption from this flaw alone. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified and there is no evidence of active exploitation. Conflicting-signal note: the vendor tag 'Authentication Bypass' aligns with PR:N/C:H, but because no CWE was supplied the precise mechanism is unconfirmed - verify against Oracle's CPU advisory. Given the sensitivity of POS data (payment context, customer and transaction records) and the trivial exploitation barrier, this should be treated as a priority patch even absent public exploit code.

An attacker who can reach a restaurant or hospitality site's Simphony POS HTTP interface - directly over the Internet or from within the venue network - sends a crafted HTTP request that bypasses authentication and returns sensitive POS data without any credentials or user interaction. Because attack complexity is low and no privileges are required, the request can be automated and repeated at scale across exposed deployments. No public proof-of-concept was identified at time of analysis.