What is the CVSS score of CVE-2026-60168?

CVE-2026-60168 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Hospitality Simphony are affected by CVE-2026-60168?

A critical vulnerability in Oracle Hospitality Simphony point-of-sale systems (versions 19.8-19.10) allows unauthenticated remote attackers to corrupt transaction records, delete sales data, and…

How to fix or mitigate CVE-2026-60168?

Within 24 hours: Restrict HTTP access to all Simphony POS installations (versions 19.8-19.8.5, 19.9-19.9.3, 19.10) through firewall rules and network segmentation, limiting connectivity to authorized administrative networks only. Within 7 days: Audit all production environments to identify affected versions and assess transaction logs for evidence of unauthorized data modification; deploy real-time monitoring and alerting on database changes and system crashes. Within 30 days: Execute upgrade path to versions beyond 19.10 or engage Oracle for remediation guidance; ensure compensating controls remain in place during any transition period.

Oracle Hospitality Simphony CVE-2026-60168

EUVD-2026-46574 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-45mx-r22v-3pcj

Authentication Bypass Oracle Oracle Hospitality Simphony Oracle Corporation

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:10 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Simphony accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Simphony. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

AnalysisAI

Data tampering and denial of service in Oracle Hospitality Simphony (POS component) versions 19.8-19.8.5, 19.9-19.9.3 and 19.10 allow a remote unauthenticated attacker to compromise the point-of-sale platform over HTTP. Successful attacks can create, delete or modify all Simphony-accessible critical data and can hang or repeatedly crash the service for a complete denial of service. Rated CVSS 3.1 9.1 with no confidentiality impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.