What is the CVSS score of CVE-2026-60591?

CVE-2026-60591 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Simphony are affected by CVE-2026-60591?

Oracle Hospitality Simphony POS (versions 19.8-19.10.1) is exposed to a critical vulnerability that enables remote attackers to tamper with transaction records, inventory, and customer data, and to…

How to fix or mitigate CVE-2026-60591?

Within 24 hours, identify and inventory all systems running Oracle Hospitality Simphony versions 19.8-19.10.1. Within 7 days, apply the Oracle August 2026 Critical Patch Update to all affected systems, prioritizing production environments, and verify backups are current before patching. Within 30 days, confirm all vulnerable versions have been updated and no legacy instances remain in operation.

Oracle Simphony CVE-2026-60591

EUVD-2026-61391 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-08-18 secalert_us@oracle.com

GHSA-4hwm-h3wc-xrfj

Authentication Bypass Oracle Hospitality Simphony

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated network HTTP access with no user interaction gives AV:N/AC:L/PR:N/UI:N; impact is data tampering and full DOS with no disclosure, so C:N/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 21:40 vuln.today

CVE Published

Aug 18, 2026 - 21:16 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10-19.10.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Simphony accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Simphony. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).

AnalysisAI

Unauthenticated data tampering and denial of service in Oracle Hospitality Simphony POS (versions 19.8-19.8.5, 19.9-19.9.3, 19.10-19.10.1) lets a remote attacker with only HTTP network access create, delete, or modify all Simphony-accessible data and force a repeatable crash. Oracle rates it CVSS 3.1 9.1 with high integrity and availability impact and describes it as easily exploitable, though there is no public exploit identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The only prerequisite is network HTTP reachability of the Oracle Hospitality Simphony POS service on an affected version (19.8-19.8.5, 19.9-19.9.3, or 19.10-19.10.1); per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and no special non-default configuration required for exploitation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes the highest-priority risk profile: network-reachable, low complexity, no privileges, and no user interaction, which Oracle reinforces by calling it 'easily exploitable.' Impact is bounded to integrity and availability (C:N/I:H/A:H), so this is a data-corruption and outage threat rather than a data-theft threat - for a live POS system, that still means falsified transactions, deleted records, and complete service crashes. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Patch available per vendor advisory: apply the fixes in the Oracle Critical Patch Update of August 2026 (https://www.oracle.com/security-alerts/cspuaug2026.html), upgrading each affected branch to the patched release above 19.8.5, 19.9.3, or 19.10.1 as listed by Oracle for your version - the input does not name a single exact fixed build, so confirm the target version in the CPU matrix. … Detailed patch versions, workarounds, and compensating controls in full report.