Oracle Simphony CVE-2026-60591

The only prerequisite is network HTTP reachability of the Oracle Hospitality Simphony POS service on an affected version (19.8-19.8.5, 19.9-19.9.3, or 19.10-19.10.1); per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and no special non-default configuration required for exploitation. The primary limiting factor is exposure: exploitation depends on the attacker being able to route HTTP traffic to the Simphony service, so deployments that keep the POS service on isolated or firewalled store/enterprise networks substantially reduce reachability, while any internet- or broadly-network-exposed instance is at direct risk.

The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes the highest-priority risk profile: network-reachable, low complexity, no privileges, and no user interaction, which Oracle reinforces by calling it 'easily exploitable.' Impact is bounded to integrity and availability (C:N/I:H/A:H), so this is a data-corruption and outage threat rather than a data-theft threat - for a live POS system, that still means falsified transactions, deleted records, and complete service crashes. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so despite the 9.1 rating there is currently no evidence of active or automated exploitation; the risk is high-potential but not yet demonstrated in the wild. The main uncertainty is exposure: real-world risk hinges on whether the affected Simphony HTTP service is reachable from untrusted networks or confined to internal/segmented deployments, which the input data does not specify.

An attacker who can reach the Simphony POS HTTP service sends crafted unauthenticated requests to a data-handling endpoint, allowing them to alter or delete critical POS records (for example, transaction, menu, or pricing data) or to repeatedly crash the service and take the point-of-sale offline during business hours. Given AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or elevated privileges are needed. No public POC is identified at this time, but Oracle's 'easily exploitable' characterization suggests weaponization would be straightforward.