Oracle disclosed a critical vulnerability in the POS component of Oracle Hospitality Simphony that lets a remote, unauthenticated attacker tamper with or destroy application data and crash the system entirely.
What Is It
CVE-2026-60591 is a vulnerability in the POS component of Oracle Hospitality Simphony, part of Oracle Food and Beverage Applications. Oracle describes it as easily exploitable: an unauthenticated attacker with network access over HTTP can compromise the product with no privileges and no user interaction required.
Successful exploitation allows unauthorized creation, deletion, or modification of critical data, or of all data accessible to Oracle Hospitality Simphony, and gives the attacker the ability to cause a hang or frequently repeatable crash, a complete denial of service.
The CVE record is still in NVD "Received" status, so no NVD-analyzed CVSS base score or vector is available yet. The severity characterization here rests on Oracle's own description of the flaw; network-reachable, unauthenticated, no user interaction, with data integrity and availability both compromised. Treat any score circulating ahead of NVD analysis as provisional.
Why It Matters
The attack path Oracle describes requires nothing from the defender's side: no stolen credentials, no phishing, no privileged foothold. Anything reachable over HTTP is a candidate for opportunistic scanning and mass exploitation rather than targeted effort.
The impact profile is unusual; Oracle describes no data disclosure, but full integrity and availability compromise. For a point-of-sale platform, that maps directly to altered or deleted transaction records and registers taken offline.
The CVE does not appear in the CISA Known Exploited Vulnerabilities catalog, so active exploitation is not confirmed at this time.
What's Vulnerable
Oracle Hospitality Simphony (Oracle Corporation), component: POS. Affected supported versions:
- 19.8 through 19.8.5
- 19.9 through 19.9.3
- 19.10 through 19.10.1
Patch Status
The CVE was published 2026-08-18 with NVD status "Received," meaning NVD analysis is not yet complete.
Oracle ships security fixes on a fixed quarterly Critical Patch Update schedule, January, April, July, and October, and does not publish a CPU advisory in August. Fixed-version and patch-availability details for this CVE will therefore appear in a quarterly CPU advisory, not an off-cycle August release. Administrators should check the current CPU advisory listing for CVE-2026-60591 and, if it is not yet covered, watch the next scheduled CPU. Oracle occasionally issues out-of-band Security Alerts for severe unauthenticated flaws; that listing is on the same page.
No required-action deadline applies, as the CVE carries no KEV entry. Administrators running the affected version ranges should confirm patch status directly with Oracle and prioritize accordingly given the unauthenticated network attack path. Until a fix is confirmed available and applied, restrict network reachability of the POS component to trusted management and store networks.
Sources
- Oracle Critical Patch Updates, Security Alerts and Bulletins; https://www.oracle.com/security-alerts/
- NVD, CVE-2026-60591, https://nvd.nist.gov/vuln/detail/CVE-2026-60591