Oracle Hospitality Simphony EUVD-2026-46575

Exploitation requires network access to the Oracle Hospitality Simphony POS component and the ability to send HTTP requests to it; per the CVSS vector (PR:N/UI:N) no authentication and no user interaction are needed. The affected deployment must run one of versions 19.8-19.8.5, 19.9-19.9.3, or 19.10. The primary limiting factor is high attack complexity (AC:H) - Oracle explicitly rates it 'difficult to exploit,' meaning success depends on conditions the attacker cannot fully control (e.g., specific timing, race, or system state), which constrains reliable exploitation. A further practical limiter is network exposure: the POS HTTP service must be reachable from the attacker's position, so environments that segment or restrict access to the POS component significantly reduce real-world exploitability.

The CVSS 3.1 base score of 8.1 (High) is driven by network attack vector, no privileges (PR:N), no user interaction, and full C:H/I:H/A:H impact, but is tempered by high attack complexity (AC:H) - Oracle explicitly describes it as 'difficult to exploit,' which materially lowers real-world likelihood versus a comparable AC:L flaw. No EPSS score, SSVC decision, KEV listing, or POC is present in the provided data, so there is no signal of active or imminent exploitation; this is not confirmed actively exploited. Note a data conflict worth verifying: the tags label this 'Information Disclosure,' yet the CVSS vector and Oracle's own wording indicate full application takeover with high integrity and availability impact - the impact is far broader than information disclosure, so defenders should treat the CVSS/Oracle description as authoritative over the tag. Net assessment: a genuinely high-severity flaw in a sensitive payment-adjacent system that merits prompt patching, but the high exploit complexity and absence of exploit evidence place it below drop-everything emergency priority.

An attacker who can reach the Simphony POS HTTP interface - for example on a poorly segmented restaurant or hospitality network, or an internet-exposed endpoint - sends specially crafted requests to the vulnerable component without needing any credentials. Because the attack is 'difficult to exploit,' the attacker likely must satisfy specific timing or state conditions or perform reconnaissance before succeeding, but a successful attack yields full takeover of the Simphony application and its confidential data. No public exploit code is currently identified, so this would require original exploit development.