CVE-2026-60167 Overview
CVE-2026-60167 is a high-severity information disclosure vulnerability in the Oracle Hospitality Simphony point-of-sale (POS) product, part of Oracle Food and Beverage Applications. Affected versions include 19.8-19.8.5, 19.9-19.9.3, and 19.10. An unauthenticated attacker with network access via HTTP can exploit the flaw to obtain unauthorized access to sensitive Simphony data. The weakness maps to [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor]. Oracle addressed the issue in the July 2026 Critical Patch Update.
Critical Impact
Remote unauthenticated attackers can obtain complete access to all data accessible through Oracle Hospitality Simphony POS, exposing hospitality transaction records, guest information, and configuration data.
Affected Products
- Oracle Hospitality Simphony versions 19.8 through 19.8.5
- Oracle Hospitality Simphony versions 19.9 through 19.9.3
- Oracle Hospitality Simphony version 19.10
Discovery Timeline
- 2026-07-21 - CVE-2026-60167 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60167
Vulnerability Analysis
CVE-2026-60167 is an information disclosure flaw in the POS component of Oracle Hospitality Simphony. The vulnerability allows a remote attacker to reach a vulnerable HTTP-facing endpoint without any authentication or user interaction. Because the flaw is classified under [CWE-200], it stems from the application returning sensitive data to a caller who should not receive it. Oracle documents the impact as unauthorized access to critical data, or complete read access to all data accessible through the Simphony service. The confidentiality impact is high, while integrity and availability are unaffected.
Root Cause
Oracle has not published detailed technical root cause information beyond the advisory. Based on the [CWE-200] classification and network-based HTTP attack surface, the flaw resides in a Simphony POS HTTP handler that fails to enforce authentication or authorization before returning data. The July 2026 Oracle Critical Patch Update supplies the corrective code.
Attack Vector
Exploitation requires only network reachability to the Simphony HTTP service. The attacker sends crafted HTTP requests to the vulnerable endpoint and retrieves sensitive data in the response. No credentials, tokens, or user interaction are required, which makes internet-exposed Simphony deployments particularly at risk. The EPSS score of 0.398% reflects a low current probability of exploitation activity, but the low complexity and lack of authentication requirement raise practical risk.
No verified public proof-of-concept code is available at this time. Refer to the Oracle Critical Patch Update - July 2026 advisory for vendor-supplied technical details.
Detection Methods for CVE-2026-60167
Indicators of Compromise
- Unexpected HTTP requests to Simphony POS service endpoints originating from external or unknown internal IP addresses.
- Anomalously large HTTP response payloads returned from the Simphony service without a preceding authenticated session.
- HTTP 200 OK responses to unauthenticated requests targeting data or configuration paths on the Simphony host.
Detection Strategies
- Inventory all Simphony servers and confirm build version; flag any host running 19.8-19.8.5, 19.9-19.9.3, or 19.10 prior to the July 2026 CPU patch.
- Deploy web application firewall or reverse proxy rules that require authenticated sessions for all Simphony API paths and log unauthenticated access attempts.
- Review historical HTTP access logs on Simphony servers for repeated unauthenticated requests to data-returning endpoints.
Monitoring Recommendations
- Alert on Simphony HTTP endpoints being reached from outside expected store or corporate network ranges.
- Baseline normal API traffic volume per client and alert on sustained anomalous data egress from POS servers.
- Correlate HTTP access logs with authentication logs to identify successful data retrieval without a corresponding auth event.
How to Mitigate CVE-2026-60167
Immediate Actions Required
- Apply the fixes from the July 2026 Oracle Critical Patch Update to every Oracle Hospitality Simphony instance in scope.
- Restrict network access to Simphony HTTP endpoints so they are reachable only from trusted POS terminals and management hosts.
- Audit HTTP access logs for signs of prior unauthenticated data retrieval against affected versions.
Patch Information
Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should follow guidance in the Oracle Critical Patch Update Advisory - July 2026 to identify the appropriate patch bundle for each Simphony release train (19.8, 19.9, or 19.10) and apply it through Oracle's supported update process. Verify version strings after patching to confirm remediation.
Workarounds
- Place Simphony HTTP services behind a reverse proxy or WAF that enforces authentication and IP allow-listing until patches are applied.
- Segment POS infrastructure onto isolated VLANs with strict egress controls to limit exposure of the vulnerable HTTP interface.
- Disable or firewall any Simphony HTTP endpoints that are not required for business operations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
