CVE-2026-60168: Oracle Hospitality Simphony Auth Bypass

CVE-2026-60168 Overview

CVE-2026-60168 is a critical access control vulnerability [CWE-284] in the Oracle Hospitality Simphony point-of-sale (POS) component of Oracle Food and Beverage Applications. The flaw affects supported versions 19.8-19.8.5, 19.9-19.9.3, and 19.10. An unauthenticated attacker with network access via HTTP can compromise Oracle Hospitality Simphony without user interaction. Successful exploitation allows unauthorized creation, deletion, or modification of critical data and can cause a complete denial-of-service (DoS) condition. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can modify or destroy all Simphony-accessible data and cause a complete DoS of the POS platform used across hospitality environments.

Affected Products

Oracle Hospitality Simphony 19.8 through 19.8.5
Oracle Hospitality Simphony 19.9 through 19.9.3
Oracle Hospitality Simphony 19.10

Discovery Timeline

2026-07-21 - CVE-2026-60168 published to NVD
2026-07-23 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the Oracle CPU July 2026 Advisory

Technical Details for CVE-2026-60168

Vulnerability Analysis

The vulnerability resides in the POS component of Oracle Hospitality Simphony, a widely deployed enterprise POS platform for restaurants, stadiums, and hospitality venues. The flaw is classified as improper access control [CWE-284], allowing remote unauthenticated attackers to reach protected functionality over HTTP. Exploitation requires no privileges and no user interaction.

Successful attacks impact integrity and availability but not confidentiality. Attackers can create, delete, or modify all data accessible to Simphony and trigger a hang or a repeatable crash resulting in complete DoS. In hospitality operations, this can disrupt order processing, payment workflows, and reporting across many terminals simultaneously.

Root Cause

Oracle's advisory characterizes the weakness as improper access control within the POS component. The underlying HTTP-facing functionality does not enforce sufficient authorization checks, permitting unauthenticated callers to invoke privileged operations against protected data and services.

Attack Vector

The attack vector is network-based over HTTP. Any attacker able to reach the exposed Simphony POS endpoint can send crafted requests to invoke restricted operations. Because Simphony is often deployed with distributed terminals communicating with central services, exposure of the affected HTTP endpoint to untrusted networks materially increases risk. No exploit code or public proof-of-concept has been published at the time of writing.

Refer to the Oracle CPU July 2026 Advisory for authoritative technical details.

Detection Methods for CVE-2026-60168

Indicators of Compromise

Unexpected creation, modification, or deletion of Simphony database records outside of normal POS transaction flows.
Unplanned Simphony service crashes, hangs, or restart loops on POS backend hosts.
Anonymous or unauthenticated HTTP requests to Simphony service endpoints originating from unusual internal or external sources.

Detection Strategies

Inspect HTTP access logs on Simphony servers for requests to administrative or data-modification endpoints lacking authentication headers or session tokens.
Correlate database integrity anomalies with request logs to identify potential unauthorized modifications.
Baseline normal POS API traffic and alert on request patterns, methods, or paths that deviate from expected client behavior.

Monitoring Recommendations

Enable verbose HTTP request logging on Simphony application servers and forward logs to a centralized SIEM for correlation.
Monitor Simphony service availability and generate alerts on repeated crashes or restart events.
Track outbound and lateral connections from Simphony hosts to detect follow-on activity after data tampering.

How to Mitigate CVE-2026-60168

Immediate Actions Required

Apply the fixes from the Oracle July 2026 Critical Patch Update to all Simphony deployments running versions 19.8-19.8.5, 19.9-19.9.3, or 19.10.
Restrict network access to Simphony POS HTTP endpoints so only trusted management networks and terminals can reach them.
Review Simphony data for unauthorized modifications, creations, or deletions since the affected versions were deployed.

Patch Information

Oracle addressed CVE-2026-60168 in the July 2026 Critical Patch Update. Administrators should consult the Oracle CPU July 2026 Advisory for the specific patch bundles applicable to their Simphony version and deployment topology.

Workarounds

Place Simphony servers behind a segmented network and enforce firewall rules that limit HTTP access to authorized POS terminals and administrative hosts.
Terminate Simphony HTTP traffic through a reverse proxy or web application firewall that enforces authentication and rate limiting until patches are applied.
Increase backup frequency for Simphony databases to enable rapid recovery from integrity or availability incidents.

bash

# Example: restrict inbound HTTP access to Simphony to authorized subnets only
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP