EUVD-2026-46575
GHSA-279h-cv64-q2h5
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor-described unauthenticated network HTTP attack (AV:N/PR:N/UI:N) that is difficult to exploit (AC:H) and yields full application takeover, so C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Simphony. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full compromise (takeover) of Oracle Hospitality Simphony is possible when an unauthenticated attacker with network access reaches the POS component over HTTP, affecting supported versions 19.8-19.8.5, 19.9-19.9.3, and 19.10. Oracle rates this CVSS 3.1 8.1 with high confidentiality, integrity, and availability impact, but flags the attack as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control such as timing, specific state, or reconnaissance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Technical ContextAI
Oracle Hospitality Simphony is an enterprise cloud-connected point-of-sale (POS) platform used by restaurants, hotels, stadiums, and food-and-beverage operators, with POS terminals and back-end services communicating over HTTP. The vulnerability resides in the POS component and is reachable via the network using HTTP, indicating the flaw is in a web-facing service or API endpoint rather than a local terminal function. Oracle did not assign a CWE (listed as N/A) and does not disclose root-cause internals in its Critical Patch Update advisories, so the exact weakness class (e.g., authentication bypass, injection, or deserialization leading to takeover) cannot be determined from the available data; the CVSS impact of C:H/I:H/A:H combined with 'takeover' language implies the flaw grants control over the application rather than mere data leakage.
RemediationAI
Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the authoritative source for the exact patched build for each affected branch (19.8.x, 19.9.x, and 19.10); Oracle's CPU advisories do not publish a single fix version string, so confirm the target build from the CPU matrix for your deployment. Because exploitation is over HTTP from the network with no authentication, until patching is complete restrict network reachability of the Simphony POS service to trusted management and terminal networks via firewall/segmentation, place it behind a VPN or reverse proxy with access controls, and monitor HTTP access logs to the POS component for anomalous unauthenticated requests - noting these controls reduce exposure but do not remediate the underlying flaw and may disrupt legitimate remote terminal or integration traffic if segmentation is too aggressive.
More in Oracle Hospitality Simphony
View allData tampering and denial of service in Oracle Hospitality Simphony (POS component) versions 19.8-19.8.5, 19.9-19.9.3 an
Unauthorized data disclosure in Oracle Hospitality Simphony POS (versions 19.8-19.8.5, 19.9-19.9.3, and 19.10) lets a re
Unauthorized data disclosure in Oracle Hospitality Simphony (POS component) versions 19.8-19.8.5, 19.9-19.9.3, and 19.10
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today