What is the CVSS score of CVE-2026-60590?

CVE-2026-60590 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Simphony are affected by CVE-2026-60590?

An unauthenticated vulnerability in Oracle Hospitality Simphony's point-of-sale system enables attackers to remotely access all customer payment data, transaction records, and operational information…

How to fix or mitigate CVE-2026-60590?

Within 24 hours: Identify and inventory all Oracle Hospitality Simphony POS instances, immediately restrict HTTP/HTTPS network access to Simphony components to known administrative IP addresses only, and enable detailed access logging for all authentication attempts and data access queries. Within 7 days: Implement a Web Application Firewall (WAF) with rules specifically blocking unauthenticated requests to sensitive POS data endpoints, deploy network segmentation to isolate POS systems from untrusted networks, and perform an audit of recent access logs to identify potential unauthorized data access. Within 30 days: Monitor Oracle Hospitality advisory channels for patch release information, prepare a patch testing and deployment plan for all affected release lines, and implement additional compensating controls including API authentication requirements and encrypted connections until a vendor patch is available.

Oracle Simphony CVE-2026-60590

EUVD-2026-61390 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-vhrf-w2g7-c2rq

Authentication Bypass Oracle Hospitality Simphony

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

HTTP-exposed POS endpoint with no authentication requirement supports AV:N/PR:N/AC:L; data-read-only impact with no write or service disruption capability justifies C:H/I:N/A:N and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 21:40 vuln.today

CVE Published

Aug 18, 2026 - 21:16 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10-19.10.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthenticated remote access to Oracle Hospitality Simphony's POS component enables complete unauthorized read access to all application data via an HTTP-based authentication bypass across three actively supported release lines. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms that no credentials, interaction, or special configuration are required - any network-reachable attacker can exploit the flaw. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires only network access to the Oracle Hospitality Simphony POS component over HTTP on an affected release (19.8-19.8.5, 19.9-19.9.3, or 19.10-19.10.1). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N represents a clear, high-confidence threat profile: no prerequisites, low attack complexity, no privileges, and no user interaction are required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the patches distributed as part of Oracle's Critical Security Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify and inventory all Oracle Hospitality Simphony POS instances, immediately restrict HTTP/HTTPS network access to Simphony components to known administrative IP addresses only, and enable detailed access logging for all authentication attempts and data access queries. …

Threat intelligence, references, and detailed analysis are available after sign-in.