CVE-2026-60168: Critical severity Oracle Oracle Hospitality Simphony vulnerability
Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality Simphony accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality Simphony. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Hospitality Simphony (POS)to a version that resolves this vulnerability.Fixed in 19.8-19.8.5 - Upgrade
Upgrade
Oracle Hospitality Simphony (POS)to a version that resolves this vulnerability.Fixed in 19.9-19.9.3 - Upgrade
Upgrade
Oracle Hospitality Simphony (POS)to a version that resolves this vulnerability.Fixed in 19.10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60168?
CVE-2026-60168 has a severity rating of critical with a score of 9.1.
How do I fix CVE-2026-60168?
To fix CVE-2026-60168, upgrade your Oracle Hospitality Simphony software to a version higher than 19.10.
What components are affected by CVE-2026-60168?
CVE-2026-60168 affects the Oracle Hospitality Simphony product within Oracle Food and Beverage Applications.
What versions are impacted by CVE-2026-60168?
The vulnerable versions for CVE-2026-60168 are 19.8-19.8.5, 19.9-19.9.3, and 19.10.
Who can exploit CVE-2026-60168?
CVE-2026-60168 can be exploited by an unauthenticated attacker with network access via HTTP.