Listen to this Post
How CVE-2026-60170 Works
CVE-2026-60170 is an authentication bypass vulnerability affecting the Kiosk application component of Oracle Hospitality Simphony, a widely deployed point‑of‑sale and food service management platform used in hotels, stadiums, casinos, quick‑service restaurants, and hospitality chains. The flaw resides in improper validation of user‑controlled input within the Kiosk administrative interface, allowing an unauthenticated attacker with network access via HTTP to completely bypass the authentication mechanism.
The Kiosk application is designed to provide self‑service ordering and payment functions, but it also exposes an administrative console for configuration and management. In a default or poorly segmented deployment, this console is reachable over the network without additional layers of protection. By sending a specially crafted HTTP request to the Kiosk endpoint, an attacker can manipulate the authentication logic and gain administrative privileges without ever presenting valid credentials.
Once authenticated as an administrator, the attacker obtains full control over the Kiosk application context. Research by Horizon3.ai has demonstrated that this administrative access can be directly leveraged to execute arbitrary code on the underlying host operating system. The attack requires no user interaction, no privileges, and is trivial to exploit due to its low complexity. The vulnerability affects Simphony versions 19.8 through 19.8.5, 19.9 through 19.9.3, and version 19.10.
From a network perspective, the attacker only needs to be able to reach the Kiosk HTTP service – typically on port 80 or 443 – which in many hospitality environments is exposed either directly to the internet or accessible from guest networks, making this a highly critical risk. The CVSS 3.1 base score is 7.5 (High) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating that confidentiality is the primary impacted property, although in practice the ability to execute code elevates the real‑world impact to potential full system compromise.
Oracle addressed this vulnerability in the July 2026 Critical Patch Update (CPU). However, because Simphony is often deployed in complex, business‑critical environments with limited maintenance windows, many installations remain unpatched. Until remediation is applied, the Kiosk administrative interface should be treated as a high‑value target for attackers, and network segmentation must be enforced to restrict access to trusted management networks only.
DailyCVE Form:
Platform: Oracle Hospitality Simphony
Version: 19.8–19.10
Vulnerability: Kiosk Authentication Bypass
Severity: High (CVSS 7.5)
date: 21 July 2026
Prediction: 15 August 2026
What Undercode Say: Analytics
The following bash commands and code snippets can be used to detect, validate, and monitor exposure to CVE‑2026‑60170.
1. Check Simphony version from the deployment manifest:
grep -E '19.[8-9]|19.10' /opt/oracle/simphony/version.txt
2. Scan for exposed Kiosk administrative endpoints using Nmap:
nmap -p 80,443 --script=http- -T4 --open <target_network>/24 | grep -i "kiosk|simphony"
3. Test for authentication bypass with a crafted HTTP GET request (proof‑of‑concept):
curl -k -X GET "https://<target_ip>/kiosk/admin/dashboard" \ -H "X-Forwarded-For: 127.0.0.1" \ -H "User-Agent: Simphony-Kiosk/1.0"
4. Monitor logs for anomalous administrative access events:
tail -f /var/log/simphony/kiosk_access.log | grep -E "admin|login|bypass"
5. Use grep to identify unpatched installations from Oracle’s CPU bulletin:
grep -E "CVE-2026-60170|July 2026 CPU" /var/log/simphony/patch_history.log
Exploit
An unauthenticated remote attacker can exploit CVE‑2026‑60170 by sending a maliciously crafted HTTP request to the Kiosk administrative console that tricks the application into granting administrative privileges without any credential verification. The attack is performed over the network, requires no user interaction, and can be executed with low skill due to the availability of public proof‑of‑concept scripts. Once inside, the attacker can execute arbitrary system commands, install backdoors, exfiltrate sensitive data (including payment card information), and pivot to other systems within the hospitality network. The exploit chain may also be combined with other Simphony vulnerabilities (CVE‑2026‑60167, CVE‑2026‑60168, CVE‑2026‑60169) to further compromise the environment.
Protection
- Immediate Patching: Apply the Oracle July 2026 Critical Patch Update (CPU) for Hospitality Simphony through My Oracle Support without delay.
- Network Segmentation: Restrict access to the Kiosk administrative interface to trusted management networks only; block direct internet exposure and limit inbound HTTP/HTTPS traffic to authorised IP ranges.
- Outbound SMB Blocking: Block outbound SMB (TCP 445) from Simphony hosts to prevent NTLM hash relay in case of combined attacks.
- Web Application Firewall (WAF): Deploy WAF rules to detect and block anomalous requests targeting `/kiosk/admin/` endpoints.
- Continuous Monitoring: Enable detailed logging for the Kiosk application and monitor for unauthorised administrative login attempts or unusual HTTP user‑agent strings.
- Vulnerability Scanning: Regularly scan for exposed Kiosk services using tools like Nmap or NodeZero Rapid Response to validate exposure and verify remediation.
Impact
Successful exploitation of CVE‑2026‑60170 allows an unauthenticated attacker to gain administrative control over the Simphony Kiosk application, which can lead to arbitrary code execution on the host system. This compromises the confidentiality, integrity, and availability of the entire Simphony deployment. Given that these systems often process sensitive payment card data and are integrated with enterprise back‑end infrastructure, an attacker can exfiltrate customer payment information, steal credentials, establish persistence, and move laterally across the network. The vulnerability is easily exploitable over the network with no authentication required, making it a prime target for ransomware groups and cybercriminals targeting the hospitality sector. Although no active exploitation has been confirmed in the wild as of the publication date, the availability of technical details and proof‑of‑concept code significantly increases the risk of imminent attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
