Oracle Hospitality Simphony
Monthly
Unauthorized data disclosure in Oracle Hospitality Simphony POS (versions 19.8-19.8.5, 19.9-19.9.3, and 19.10) lets a remote, unauthenticated attacker reach all data accessible to the application over HTTP. Oracle rates it CVSS 7.5 with confidentiality-only impact and describes it as 'easily exploitable,' and the vendor tags it as an Authentication Bypass. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise (takeover) of Oracle Hospitality Simphony is possible when an unauthenticated attacker with network access reaches the POS component over HTTP, affecting supported versions 19.8-19.8.5, 19.9-19.9.3, and 19.10. Oracle rates this CVSS 3.1 8.1 with high confidentiality, integrity, and availability impact, but flags the attack as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control such as timing, specific state, or reconnaissance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Data tampering and denial of service in Oracle Hospitality Simphony (POS component) versions 19.8-19.8.5, 19.9-19.9.3 and 19.10 allow a remote unauthenticated attacker to compromise the point-of-sale platform over HTTP. Successful attacks can create, delete or modify all Simphony-accessible critical data and can hang or repeatedly crash the service for a complete denial of service. Rated CVSS 3.1 9.1 with no confidentiality impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Hospitality Simphony (POS component) versions 19.8-19.8.5, 19.9-19.9.3, and 19.10 lets a remote, unauthenticated attacker read all data accessible to the application over HTTP. The flaw, tagged as an authentication bypass, requires no privileges or user interaction and yields high confidentiality impact (CVSS 3.1 base 7.5) with no impact to integrity or availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is currently theoretical but the low attack complexity makes it a real patching priority.
Unauthorized data disclosure in Oracle Hospitality Simphony POS (versions 19.8-19.8.5, 19.9-19.9.3, and 19.10) lets a remote, unauthenticated attacker reach all data accessible to the application over HTTP. Oracle rates it CVSS 7.5 with confidentiality-only impact and describes it as 'easily exploitable,' and the vendor tags it as an Authentication Bypass. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise (takeover) of Oracle Hospitality Simphony is possible when an unauthenticated attacker with network access reaches the POS component over HTTP, affecting supported versions 19.8-19.8.5, 19.9-19.9.3, and 19.10. Oracle rates this CVSS 3.1 8.1 with high confidentiality, integrity, and availability impact, but flags the attack as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control such as timing, specific state, or reconnaissance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Data tampering and denial of service in Oracle Hospitality Simphony (POS component) versions 19.8-19.8.5, 19.9-19.9.3 and 19.10 allow a remote unauthenticated attacker to compromise the point-of-sale platform over HTTP. Successful attacks can create, delete or modify all Simphony-accessible critical data and can hang or repeatedly crash the service for a complete denial of service. Rated CVSS 3.1 9.1 with no confidentiality impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Hospitality Simphony (POS component) versions 19.8-19.8.5, 19.9-19.9.3, and 19.10 lets a remote, unauthenticated attacker read all data accessible to the application over HTTP. The flaw, tagged as an authentication bypass, requires no privileges or user interaction and yields high confidentiality impact (CVSS 3.1 base 7.5) with no impact to integrity or availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is currently theoretical but the low attack complexity makes it a real patching priority.