Oracle Simphony: Four Critical CVEs Expose Hospitality POS to RCE

Four vulnerabilities in Oracle Hospitality Simphony enable unauthenticated remote code execution and NTLM hash theft. Patches released July 21, 2026.

Oracle released patches on July 21, 2026 for four vulnerabilities in Hospitality Simphony, the POS platform used across hotel chains, quick-service restaurants, stadiums, and casinos. The flaws, discovered and responsibly disclosed by Horizon3.ai researcher Jimi Sebree, allow an unauthenticated attacker to obtain NTLM hashes, write arbitrary files, and execute remote code on payment systems. The problem extends beyond a single terminal: hospitality POS devices are often overexposed network nodes connected to corporate infrastructure and subject to PCI-DSS requirements that a compromise immediately violates.

Key Takeaways

Four CVEs (CVE-2026-60167, CVE-2026-60168, CVE-2026-60169, CVE-2026-60170) affect Oracle Hospitality Simphony versions 19.8-19.8.5, 19.9-19.9.3, and 19.10.
CVE-2026-60168 carries the highest score: CVSS 9.1 with high integrity and availability impact (I:H/A:H), and CISA-ADP rates it technicalImpact total and automatable: yes.
The EGateway Printing Handler is the entry point for three flaws: UNC path coercion for NTLM hash theft and an arbitrary file write chain.
CVE-2026-60170 in the Simphony Kiosk application enables authentication bypass and subsequent arbitrary code execution on the underlying host.

How the Attack Works: From EGateway to System Control

The vulnerabilities center on two distinct Simphony platform components with a common root: insufficient validation of attacker-controlled input. In the EGateway Printing Handler, CVE-2026-60167 exploits UNC path coercion. The attacker sends a crafted network path that forces the Simphony system to initiate an outbound SMB connection. At that point, per Horizon3.ai's technical description, "Windows may automatically transmit NTLM authentication material during this connection." Captured hashes can be cracked offline or relayed to other systems.

CVE-2026-60168 and CVE-2026-60169 operate as a chain within the same printing component. Oracle assigned two identifiers to "distinct weaknesses within the processing chain that together create a single arbitrary file write condition," as the Horizon3.ai advisory states. The lack of input validation before file operations allows writing arbitrary data to the server filesystem, with potential overwrite of critical system or application files.

The fourth flaw, CVE-2026-60170, hits the Simphony Kiosk application. An authentication bypass via malformed input grants access to the administrative console. Horizon3.ai demonstrated that "this unauthorized administrative access can be leveraged to execute arbitrary code on the underlying host." The path from authentication bypass to RCE is documented and verified.

The Numbers: CVSS Scores and an Anomaly to Explain

The four CVEs present differentiated risk profiles. Per NVD records, CVE-2026-60168 reaches CVSS 9.1 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H: network accessible, low attack complexity, no privileges or user interaction required, with maximum impact on integrity and availability. CISA-ADP confirms the severity with technicalImpact: total and automatable: yes, signaling that attack automation is fully feasible.

CVE-2026-60169 has an anomalous profile: CVSS 8.1 with vector C:H/I:H/A:H but AC:H, making it the only one of the four with "High" attack complexity. CISA-ADP assigns technicalImpact: total but automatable: no, contrasting with the other three CVEs. The discrepancy is not explained in detail in available sources: the AC:H may reflect specific exploit chain conditions or timing requirements, but the dossier provides no clarification.

"Oracle assigned two CVEs to distinct weaknesses within the processing chain that together create a single arbitrary file write condition" — Horizon3.ai advisory

CVE-2026-60167 and CVE-2026-60170 both share CVSS 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Impact is limited to confidentiality (hash theft), with no direct effect on integrity or availability. The combination of all four CVEs, however, exposes the system to complex scenarios: credential theft, persistence via file write, and remote control via RCE.

What to Do Now

Apply patches released in Oracle's Critical Patch Update of July 21, 2026; access to fixes requires My Oracle Support credentials.
Scan internal networks for affected versions (19.8-19.8.5, 19.9-19.9.3, 19.10) and plan updates or isolation of unpatchable systems.
Reduce outbound SMB visibility from Simphony servers to untrusted networks, limiting the attack surface for CVE-2026-60167's UNC path coercion.
Monitor Simphony Kiosk application authentication logs for anomalous administrative access that may indicate CVE-2026-60170 exploitation attempts.

Why the POS Is Enterprise Security's Forgotten Bridge

Hospitality point-of-sale systems represent an exposure paradox: they process sensitive payment data, fall under PCI-DSS compliance, yet often receive less security attention than ERP servers or corporate workstations. Their network connectivity—required for menu synchronization, order management, and centralized reporting—turns them into ideal pivots for lateral movement. The four Simphony flaws require no prior authentication, drastically lowering the access threshold for an attacker.

The absence of confirmed in-the-wild exploitation, documented by Horizon3.ai, does not diminish the risk: publication of the technical advisory and inclusion in Oracle's Critical Patch Update make the vulnerabilities objectively discoverable. CISA-ADP's assessment of CVE-2026-60168 (automatable: yes) further indicates that automated exploit tools are technically feasible.

The dossier does not quantify the exact number of internet-exposed systems. Oracle states that "Earlier unsupported releases were not evaluated," leaving open the question of versions prior to 19.8. It is unknown whether public exploits exist beyond Horizon3.ai's NodeZero testing. These gaps do not reduce patch criticality but highlight monitoring areas for security teams.

FAQ

Are the vulnerabilities interconnected or independent?

There are two separate clusters: three CVEs in the EGateway Printing Handler (CVE-2026-60167, CVE-2026-60168, CVE-2026-60169) and one in the Simphony Kiosk (CVE-2026-60170). Within the first cluster, CVE-2026-60168 and CVE-2026-60169 form a chain for arbitrary file write.

Why does CVE-2026-60169 have AC:H while the others have AC:L?

The NVD record indicates "Difficult to exploit vulnerability" for CVE-2026-60169, but sources do not explain the reason for the difference compared to the other three CVEs. The discrepancy remains documented but unclarified in the available brief.

Are cloud systems affected?

The dossier does not specify whether Oracle Hospitality Simphony cloud instances are managed by the vendor or the customer, nor whether Oracle applies patches in a managed fashion. Verification falls to the individual operator.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references