This vulnerability affects Oracle Hospitality Simphony, specifically versions 19.8, 19.9, and 19.10. It is an easily exploitable flaw that requires no authentication and can be triggered remotely over HTTP. Successful exploitation grants an attacker unauthorized ability to create, delete, or modify critical data within the system, as well as cause the application to hang or crash repeatedly, resulting in a complete denial of service. The CVSS vector indicates no privileges or user interaction are required, with network attack vector and low attack complexity. The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory references a Critical Patch Update released in July 2026 but does not explicitly confirm a patch for this specific vulnerability within the advisory content provided.

An attacker can remotely exploit this vulnerability without authentication to gain unauthorized access to modify critical data in Oracle Hospitality Simphony or cause a denial of service by hanging or crashing the application. This compromises data integrity and system availability, potentially disrupting business operations dependent on the affected software.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a patch is confirmed and applied, restrict network access to Oracle Hospitality Simphony HTTP interfaces to trusted sources only to reduce exposure.