External risk intelligence

Oracle Hospitality Simphony Network Data Integrity and Denial of Service Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-60168

This Oracle Hospitality Simphony POS system is typically deployed in segmented, internal business networks. While the vulnerability requires network access via HTTP, these systems are not designed for direct public internet exposure. Internet reachability is therefore a consequence of specific, non-standard deployment choices rather than typical intended use.

Oracle Hospitality Simphony

19.8 to 19.8.519.9 to 19.9.319.10

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Hospitality Simphony, a point-of-sale system used in the food and beverage industry. This issue, if exploited, could allow unauthorized access to alter or delete critical data, or cause significant disruptions through system crashes. The primary concern is confirming whether our organization utilizes this specific Oracle product and if it is exposed in a manner that could be targeted.

Unauthenticated attackers could alter or crash the system.
Key hospitality system could be compromised remotely.
Confirm if we use this Oracle product and its exposure.

Attack Path

How an attacker could exploit the issue

An attacker with network access can target Oracle Hospitality Simphony's Point of Sale (POS) component. Exploiting this vulnerability through unauthenticated network requests could allow an attacker to alter or delete critical data, or cause the system to crash.

Attacker needs network access.
Attacker triggers through HTTP requests.
Risk of data corruption or denial of service.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access could alter or delete critical data within Oracle Hospitality Simphony, or cause the system to crash. This could occur when the system is exposed to the network without proper authentication.

Critical system data could be affected.
Network access could lead to exposure.
System integrity and availability may be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

In a typical deployment, the Oracle Hospitality Simphony product is managed by the application owner, with infrastructure and network/security teams responsible for the underlying systems and their accessibility. The immediate first step is to locate all instances of this product, confirm their network exposure and business criticality, and then identify the accountable owner to initiate a risk-based remediation plan.

Application and infrastructure teams own the issue.
Verify system reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Hospitality Simphony?

Oracle Hospitality Simphony is a specialized point-of-sale (POS) software platform widely used in the food and beverage industry. It serves as the central engine for managing transactions, menu items, and operational data across restaurants and hospitality venues. The POS component acts as the interface for these critical business functions, handling real-time data processing and customer service activities within the establishment's network.

What does CVE-2026-60168 mean for my system?

This CVE indicates a critical security weakness that allows an unauthenticated attacker to interact with the POS component via HTTP. Essentially, the software fails to properly verify or restrict incoming network requests. This flaw enables unauthorized parties to manipulate, delete, or overwrite sensitive business data and can force the system to crash, leading to a complete loss of service availability.

How can an attacker trigger this vulnerability?

An attacker initiates this vulnerability by sending specially crafted HTTP requests to the targeted POS component. Because the system does not require authentication for these requests, no prior user session or login credentials are necessary. Note that this flaw is specifically tied to these network-based HTTP interactions; local physical actions at a POS terminal are not the primary mechanism described for this remote exploit.

Is my Oracle Hospitality Simphony installation at risk?

Risk depends on your network architecture. According to Halo Surface Signal, this software is typically kept within segmented, internal business networks and is not meant to be public-facing. However, if your specific deployment allows direct internet access to these POS services—either intentionally or due to a misconfiguration—the system becomes significantly more vulnerable to remote exploitation.

What should I do if I run this software?

Begin by auditing your environment to locate all active instances of Oracle Hospitality Simphony. Once identified, verify their current network accessibility and determine if any instances are exposed to the broader internet. Engage the relevant application and infrastructure teams to assess business criticality, identify the owners for these specific assets, and establish a plan to restrict network access while preparing for vendor-provided updates.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.