CVE-2026-60590
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Vulnerability in Oracle Hospitality Simphony (component: POS). Affected versions are 19.8-19.8.5, 19.9-19.9.3 and 19.10-19.10.1. Easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks can result in unauthorized access to critical data or complete access to all data.
Risk Assessment
Risk includes exposure of sensitive data such as customer and transaction information, potentially leading to privacy breaches and financial losses.
Recommendation
Apply patches provided by Oracle for affected versions. Restrict access to the POS system to trusted networks only.
Original NVD description (English source)
Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10-19.10.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).