CVE-2026-60170: High severity Oracle Oracle Hospitality Simphony vulnerability
Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS). Supported versions that are affected are 19.8-19.8.5, 19.9-19.9.3 and 19.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Simphony accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Hospitality Simphony (Oracle Food and Beverage Applications)to a version that resolves this vulnerability.Fixed in 19.8-19.8.5 - Upgrade
Upgrade
Oracle Hospitality Simphony (Oracle Food and Beverage Applications)to a version that resolves this vulnerability.Fixed in 19.9-19.9.3 - Upgrade
Upgrade
Oracle Hospitality Simphony (Oracle Food and Beverage Applications)to a version that resolves this vulnerability.Fixed in 19.10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60170?
The severity of CVE-2026-60170 is rated as high with a CVSS score of 7.5.
How do I fix CVE-2026-60170?
To mitigate CVE-2026-60170, upgrade to a non-vulnerable version of Oracle Hospitality Simphony beyond 19.10.
Who is affected by CVE-2026-60170?
Organizations using Oracle Hospitality Simphony versions 19.8-19.8.5, 19.9-19.9.3, and 19.10 are affected by CVE-2026-60170.
What attack vector is associated with CVE-2026-60170?
CVE-2026-60170 can be exploited by an unauthenticated attacker with network access via HTTP.
What type of access does CVE-2026-60170 allow for attackers?
CVE-2026-60170 allows attackers to compromise the system but does not affect integrity or availability.