What is the CVSS score of CVE-2026-60170?

CVE-2026-60170 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Hospitality Simphony are affected by CVE-2026-60170?

Oracle Hospitality Simphony POS versions 19.8 through 19.10 contain an unauthenticated remote authentication bypass allowing attackers to access payment and customer data without credentials.

How to fix or mitigate CVE-2026-60170?

Within 24 hours: audit your Simphony deployment to identify all systems running versions 19.8-19.8.5, 19.9-19.9.3, or 19.10 and implement network-level access restrictions to limit exposure of the POS application. Within 7 days: enable comprehensive logging and monitoring for unauthorized data access attempts; coordinate with your point-of-sale provider and Oracle for interim security guidance; prepare communications to affected business units. Within 30 days: develop a remediation roadmap focusing on either upgrading to patched versions once available or migrating to unaffected alternative POS solutions; monitor Oracle advisories weekly for patch releases and expedite testing of any updates.

Oracle Hospitality Simphony CVE-2026-60170

EUVD-2026-46576 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-j5mf-c9m3-5cvr

Authentication Bypass Oracle Oracle Hospitality Simphony Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:09 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Hospitality Simphony POS (versions 19.8-19.8.5, 19.9-19.9.3, and 19.10) lets a remote, unauthenticated attacker reach all data accessible to the application over HTTP. Oracle rates it CVSS 7.5 with confidentiality-only impact and describes it as 'easily exploitable,' and the vendor tags it as an Authentication Bypass. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.