CVE-2026-60170: Oracle Hospitality Simphony Auth Bypass

CVE-2026-60170 Overview

CVE-2026-60170 is a high-severity access control vulnerability in the Oracle Hospitality Simphony point-of-sale (POS) component of Oracle Food and Beverage Applications. The flaw affects supported versions 19.8-19.8.5, 19.9-19.9.3, and 19.10. An unauthenticated attacker with network access via HTTP can exploit the vulnerability with low attack complexity. Successful exploitation can result in unauthorized read access to critical Simphony data, including all data accessible through the POS component. The weakness maps to [CWE-284] Improper Access Control.

Critical Impact
Unauthenticated remote attackers can access sensitive hospitality and payment-adjacent data through the Simphony POS interface over HTTP without user interaction.

Affected Products

Oracle Hospitality Simphony versions 19.8 through 19.8.5
Oracle Hospitality Simphony versions 19.9 through 19.9.3
Oracle Hospitality Simphony version 19.10

Discovery Timeline

2026-07-21 - CVE-2026-60170 published to NVD as part of the Oracle Critical Patch Update advisory
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60170

Vulnerability Analysis

CVE-2026-60170 is an improper access control weakness in the POS component of Oracle Hospitality Simphony. The vulnerability is remotely exploitable over HTTP and requires no authentication or user interaction. Oracle classifies the impact as confidentiality-only, meaning the flaw enables data disclosure rather than modification or service disruption.

Simphony is a cloud-based enterprise POS platform deployed across restaurants, hotels, stadiums, and other hospitality venues. Exposure of Simphony data can include order history, employee records, configuration data, and other operational information tied to the POS environment. The confidentiality-only impact profile makes this vulnerability well-suited for opportunistic data harvesting against internet-reachable Simphony deployments.

Root Cause

The underlying weakness is categorized as [CWE-284] Improper Access Control. Oracle has not published component-level technical details in the public advisory. The vendor advisory in the Oracle Critical Patch Update (Oracle Security Alert July 2026) is the authoritative source for affected component and fix information.

Attack Vector

The attack path is network-based over HTTP. An attacker sends crafted HTTP requests to an exposed Simphony POS endpoint from any network position that can reach the service. No credentials, tokens, or session context are required. Because the vulnerability requires no privileges and no user interaction, exploitation can be fully automated against reachable Simphony instances.

No public proof-of-concept exploit or in-the-wild exploitation has been reported at the time of publication. See the Oracle Security Alert July 2026 for vendor-supplied technical context.

Detection Methods for CVE-2026-60170

Indicators of Compromise

Anomalous unauthenticated HTTP requests to Simphony POS endpoints, especially from external or non-corporate IP ranges.
Repeated HTTP GET or POST requests to Simphony API paths returning large or structured JSON payloads.
Unusual outbound data volume from Simphony application servers correlated with inbound HTTP traffic spikes.

Detection Strategies

Inventory all Simphony deployments and confirm versions against the affected ranges (19.8-19.8.5, 19.9-19.9.3, 19.10).
Deploy web application firewall or reverse proxy rules that log and rate-limit unauthenticated requests to Simphony endpoints.
Correlate HTTP access logs with authentication logs to surface requests that access data without a valid session.

Monitoring Recommendations

Monitor Simphony application and web server logs for high-volume requests from single source IPs.
Alert on HTTP 200 responses to unauthenticated requests that return sensitive data structures.
Track egress traffic from Simphony hosts and flag deviations from baseline volumes.

How to Mitigate CVE-2026-60170

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes for Oracle Hospitality Simphony without delay.
Restrict network access to Simphony POS endpoints to trusted management and store networks only.
Place internet-facing Simphony services behind a reverse proxy or VPN and remove direct public exposure.
Audit Simphony access logs for the period preceding patch deployment to identify potential data exposure.

Patch Information

Oracle addressed CVE-2026-60170 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 advisory for the specific patch identifiers and upgrade paths for each affected 19.8, 19.9, and 19.10 release line.

Workarounds

Block untrusted network access to Simphony HTTP endpoints at the perimeter firewall until patching is complete.
Enforce IP allowlisting on load balancers or WAFs fronting Simphony application servers.
Disable or restrict any Simphony-facing HTTP interfaces that are not required for business operations.

bash

# Example: restrict Simphony HTTP access to trusted store subnet using iptables
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP