What is the CVSS score of EUVD-2026-46573?

EUVD-2026-46573 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Hospitality Simphony are affected by EUVD-2026-46573?

Oracle Hospitality Simphony POS systems (versions 19.8-19.10) contain an authentication bypass allowing remote, unauthenticated attackers to read all customer transaction and payment data without…

How to fix or mitigate EUVD-2026-46573?

Within 24 hours, audit your infrastructure to identify all Simphony 19.8, 19.9, and 19.10 instances and immediately apply firewall rules restricting application access to trusted administrative networks only; contact your Oracle account team to determine patch release timeline. Within 7 days, deploy Web Application Firewall rules to block unauthenticated requests to sensitive data endpoints, enable comprehensive audit logging of all data access attempts, and isolate affected POS systems on dedicated network segments separate from general business infrastructure. Within 30 days, apply the vendor-released patch from Oracle immediately upon release, conduct a forensic audit of all system logs during the vulnerable period to identify unauthorized access, and perform a data scope assessment if suspicious activity is detected.

Oracle Hospitality Simphony EUVD-2026-46573

| CVE-2026-60167 HIGH

Information Exposure (CWE-200)

2026-07-21 oracle

GHSA-m6r4-hh78-25rp

Authentication Bypass Information Disclosure Oracle Oracle Hospitality Simphony Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network HTTP authentication bypass (AV:N/AC:L/PR:N/UI:N) yielding full read access to POS data, so C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:10 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Hospitality Simphony (POS component) versions 19.8-19.8.5, 19.9-19.9.3, and 19.10 lets a remote, unauthenticated attacker read all data accessible to the application over HTTP. The flaw, tagged as an authentication bypass, requires no privileges or user interaction and yields high confidentiality impact (CVSS 3.1 base 7.5) with no impact to integrity or availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is currently theoretical but the low attack complexity makes it a real patching priority.

Technical ContextAI

Oracle Hospitality Simphony is Oracle Food and Beverage's cloud-connected enterprise point-of-sale platform used by restaurants, hotels, and stadiums to process orders, payments, and menu/back-office data. The affected element is the POS component, exposed over HTTP. The vendor tag 'Authentication Bypass' indicates the root cause is a missing or improper authentication check (analogous to CWE-287 Improper Authentication / CWE-306 Missing Authentication for a Critical Function), allowing a request to reach data-serving functionality without a valid session. The CWE was not populated (N/A) in the source data, so the exact weakness class is inferred from the vendor tag rather than confirmed. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_hospitality_simphony, and the CVSS vector (C:H/I:N/A:N) confirms the exposure is purely a read/disclosure primitive rather than code execution or data tampering.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle distributes Simphony fixes through the CPU rather than as a standalone tagged release, so patch to the corrected build for your branch (19.8.x, 19.9.x, or 19.10) as specified in that advisory - no exact standalone fix version was provided in the input data, so confirm the target build number from the CPU. Because the vector is unauthenticated HTTP, the most effective compensating control until patching is to restrict network reachability of the Simphony POS HTTP interface: place it behind a VPN or firewall so only trusted POS terminals and management hosts can connect, and block direct Internet exposure (side effect: remote/cloud-connected terminals may need VPN reconfiguration). Add WAF/reverse-proxy authentication or IP allowlisting in front of the POS endpoint as a secondary layer, and monitor HTTP access logs for anomalous unauthenticated data-retrieval requests. These are stopgaps only - the authentication bypass itself is fixed solely by applying the vendor update.