Oracle Simphony CVE-2026-60590

Exploitation requires only network access to the Oracle Hospitality Simphony POS component over HTTP on an affected release (19.8-19.8.5, 19.9-19.9.3, or 19.10-19.10.1). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated remote exploitation against default configurations of Oracle Simphony - no special setup, feature flag, or operator action is needed to be vulnerable. Limiting factors include: network segmentation or firewall rules isolating POS systems from untrusted networks would block external exploitation; the scored impact is confidentiality-only, meaning the attacker cannot write data or disrupt POS availability through this vector alone; and only the three listed release lines are confirmed affected - operators on fully patched or out-of-scope versions are not exposed.

The CVSS 3.1 base score of 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N represents a clear, high-confidence threat profile: no prerequisites, low attack complexity, no privileges, and no user interaction are required. Oracle's own advisory language - 'easily exploitable' - further signals that exploitation automation is plausible and that the barrier to entry is exceptionally low. No EPSS data was included in the available intelligence feed, but the combination of network attack vector, low complexity, and no authentication historically correlates with elevated EPSS percentiles for similar Oracle advisories. The absence from CISA KEV and the lack of reported public exploit code moderately temper immediate exploitation probability, though this gap may close rapidly given the simplicity of the attack surface. Impact is scoped strictly to confidentiality - no integrity or availability dimension is scored - limiting consequences to data exfiltration rather than POS service disruption. Nonetheless, Simphony environments routinely store transaction histories, loyalty data, and potentially payment-adjacent records, making unauthorized read access operationally and regulatorily significant; even a mid-sized hospitality operator in sanok should treat this as a priority remediation item rather than deferring to a routine maintenance cycle. No conflicting signals between the available intelligence sources were identified.

An unauthenticated attacker with HTTP network access to a Simphony POS endpoint sends a crafted request that bypasses the missing or improperly enforced authentication check, gaining direct read access to all data accessible within the Simphony application - including transaction records, customer information, and system configuration. No public exploit code exists at time of analysis, but the low attack complexity and absence of any privilege requirement mean the attack is likely straightforward to reproduce once the vulnerable endpoint path is identified through enumeration or analysis of the advisory.