This vulnerability affects Oracle Hospitality Simphony, specifically versions 19.8, 19.9, and 19.10. It is an easily exploitable issue that permits unauthenticated attackers with network access over HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact with no integrity or availability impact. The vendor advisory from Oracle references a Critical Patch Update released in July 2026 but does not explicitly state patch availability or remediation details for this vulnerability in the provided excerpt.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Hospitality Simphony. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector. The vulnerability is exploitable remotely without authentication, increasing the risk to affected deployments.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Hospitality Simphony HTTP interfaces to trusted sources only.