Oracle Simphony POS: six flaws, one with a public exploit
Six unauthenticated flaws in Oracle Hospitality Simphony POS, patched in the July and August 2026 CPUs. A public proof of concept exists for the worst.
Who is affected
- Oracle Hospitality Simphony 19.8 to 19.8.5, 19.9 to 19.9.3 and 19.10 (July 2026 CPU)
- Oracle Hospitality Simphony 19.8 to 19.8.5, 19.9 to 19.9.3 and 19.10 to 19.10.1 (August 2026 CPU)
- Simphony POS terminals and servers running on property: restaurants, bars, room service, spas, conference venues
- POS admin interfaces and HTTP services reachable from guest Wi-Fi, conference VLANs or the internet
How to fix
Apply the fixes shipped in the July 21 and August 18, 2026 Oracle security updates (CPU), the only corrections published for versions 19.8 to 19.10.1. Ask your integrator in writing which Simphony build runs in each property and whether it is patched, with the date of the last upgrade. Confirm that the POS HTTP services and admin interface are reachable neither from the internet nor from guest or conference Wi-Fi VLANs: firewall rules should confine those ports to the operational network. Treat CVE-2026-60591 as the most urgent of the six, because a public proof of concept exists. If exposure is found before patching, audit the period since July 21; Oracle has not published indicators of compromise.
What happened
Oracle fixed six vulnerabilities in the POS component of Oracle Hospitality Simphony, its point-of-sale platform for food, beverage and hotels, in two quarterly security updates. All six, as described on their NVD entries, are reachable over HTTP by an unauthenticated attacker, no login required. The July 21 and August 18, 2026 corrective security patches (CPUs) cover versions 19.8 through 19.10.1.
| CVE | CVSS 3.1 | Impact of a successful attack | Fix |
|---|---|---|---|
| CVE-2026-60167 | 7.5 | Full read access to the data Simphony can reach | July 2026 CPU |
| CVE-2026-60168 | 9.1 | Unauthorized creation, deletion or modification of critical data, plus complete denial of service | July 2026 CPU |
| CVE-2026-60169 | 8.1 | Takeover of Simphony (missing authentication, CWE-306) | July 2026 CPU |
| CVE-2026-60170 | 7.5 | Full read access to the data Simphony can reach | July 2026 CPU |
| CVE-2026-60590 | 7.5 | Full read access to the data Simphony can reach | August 2026 CPU |
| CVE-2026-60591 | 9.1 | Unauthorized creation, deletion or modification of critical data, plus complete denial of service | August 2026 CPU |
Oracle rates five of the six as easily exploitable. Only CVE-2026-60169 is classified as difficult to attack, yet it leads to full product takeover. The August CPU extended the affected range to 19.10.1, the most recent version at the time of the patches.
As of this advisory, neither Oracle nor the NVD reports exploitation in the wild. The SSVC assessment shown on the NVD pages marks five of the six CVEs as "none"; CVE-2026-60591 is marked "poc", meaning public demonstration code exists without observed use. None of the six appears in CISA's KEV catalog, the list of vulnerabilities exploited and ordered to be fixed.
Why a hotel should care
Simphony runs the outlets of a property: restaurants, bars, room service, spa, conference halls, along with checks, guest profiles and sales history. The published attack vector is plain network access over HTTP: no username, no password. The useful question is therefore not "do we have a weak account" but "which reachable address exposes the POS service". A POS belongs on the operational network; if it answers on guest Wi-Fi, a conference-center VLAN or, worse, the open internet, any automated scanner can find it. The published impacts are reading and altering application data, crashing the service, and, for CVE-2026-60169, full takeover. Oracle does not state whether payment card data falls inside the exposed scope; that question belongs to your acquirer and your PCI DSS scope review.
Who is affected
Versions 19.8 to 19.8.5, 19.9 to 19.9.3 and 19.10 for the four July CPU CVEs, and the same ranges extended to 19.10.1 for the two August CPU CVEs, per the NVD. On-premise deployments apply the patches directly; for a hosted instance, the question of when the fix was applied goes to the provider and the integrator.
How to fix it
- Ask your integrator in writing which Simphony build runs in each property (19.8 to 19.10.1) and whether the July 21 and August 18, 2026 updates are installed, with dates.
- Schedule the upgrade with the integrator. Treat CVE-2026-60591 as the priority if the service is exposed, because public proof-of-concept code exists.
- Verify that the POS HTTP services and the admin interface answer on no address reachable from the internet or from guest and conference Wi-Fi: firewall rules should confine those ports to the operational network.
- If exposure is found before patching, audit the period since July 21: abnormal HTTP requests against the POS service, inventory or cash discrepancies, unexplained restarts. Oracle has not published indicators of compromise.
- Keep written answers from the integrator on file. The service contract, not goodwill, is what gets a vendor patch to the till.
Context
Two waves in two months against the same component point to sustained research attention on this vendor's POS. The fix path is identical for all six CVEs: Oracle's quarterly updates, which assume a maintenance plan at the hotel or its integrator. For a general manager, the lesson is contractual as much as technical. How fast a vendor fix reaches the tills depends on the agreement signed with the integrator, so ask for that clause, and the date of the last drill, before the next wave lands.