CVE-2026-60168
A critical flaw in Oracle Hospitality Simphony allows attackers with network access to create, delete, or modify data and cause crashes. The vulnerability can be exploited without authentication and is easy to use over HTTP.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle Hospitality Simphony versions 19.8 through 19.10 (including 19.8.5, 19.9.3, and 19.10) used in food and beverage applications.
Real-world impact
An attacker could alter or delete critical data and bring the system down, disrupting restaurant operations.
Why this severity
The CVSS score of 9.1 reflects that the flaw can be exploited without authentication, has high impact on integrity and availability, and is easy to exploit over the network.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources