This vulnerability affects Oracle Hospitality Simphony, a point-of-sale component of Oracle Food and Beverage Applications, specifically versions 19.8 to 19.10. It permits unauthenticated attackers to exploit the system over HTTP to compromise data confidentiality. The CVSS 3.1 base score is 7.5, indicating high severity, with attack vector as network, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory mentions multiple patches but does not explicitly confirm a fix for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Hospitality Simphony, compromising confidentiality. There is no reported impact on integrity or availability. The vulnerability can be exploited remotely without authentication, increasing the risk of data exposure.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses numerous vulnerabilities across its product portfolio. However, the advisory does not explicitly confirm a patch or remediation for CVE-2026-60170. Users should monitor the Oracle advisory for updates and apply any relevant patches promptly once available. Until an official fix is confirmed, restrict network access to Oracle Hospitality Simphony instances and apply compensating controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.