This vulnerability affects Oracle Hospitality Simphony versions 19.8-19.8.5, 19.9-19.9.3, and 19.10-19.10.1. It is easily exploitable by unauthenticated attackers over the network via HTTP. Successful exploitation can result in unauthorized modification of critical data and denial of service through system hangs or frequent crashes. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) indicates no confidentiality impact but high integrity and availability impacts. Oracle has published this vulnerability as part of their August 2026 Critical Security Patch Update advisory, which includes numerous patches across many products. However, the specific patch availability for this vulnerability is not explicitly stated in the provided advisory content.

An attacker can remotely and without authentication compromise Oracle Hospitality Simphony, leading to unauthorized creation, deletion, or modification of critical data. Additionally, the attacker can cause the system to hang or crash repeatedly, resulting in a complete denial of service. The vulnerability impacts data integrity and system availability but does not affect confidentiality.

Oracle strongly recommends applying the security patches included in the August 2026 Critical Security Patch Update. Customers should remain on actively supported versions and apply patches without delay to mitigate this vulnerability. Since the vendor advisory does not explicitly state that no action is required or that the issue is already mitigated, patching is the advised remediation. Check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions.