CVE-2026-60167: Infoleak
Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict HTTP network access to the Oracle Hospitality Simphony POS component (allow only trusted clients) to mitigate unauthenticated remote exploitation via HTTP.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60167?
CVE-2026-60167 has a high severity score of 7.5.
What versions of Oracle Hospitality Simphony are affected by CVE-2026-60167?
The affected versions of Oracle Hospitality Simphony are 19.8-19.8.5, 19.9-19.9.3, and 19.10.
How can I fix CVE-2026-60167?
To fix CVE-2026-60167, it is recommended to apply the latest security patches provided by Oracle.
What type of vulnerability is CVE-2026-60167?
CVE-2026-60167 is classified as an infoleak vulnerability.
Who can exploit the CVE-2026-60167 vulnerability?
CVE-2026-60167 can be exploited by an unauthenticated attacker with network access via HTTP.