An unauthenticated remote vulnerability in Oracle Hospitality Simphony allows an attacker with network access to the HTTP interface to retrieve critical data. The flaw requires no credentials and can be leveraged simply by sending a crafted request over the network. Once exploited, the attacker can read information exposed by the application, resulting in a confidentiality compromise without affecting integrity or availability.

Oracle Hospitality Simphony, part of Oracle Food and Beverage Applications, is affected in the following supported versions: 19.8 through 19.8.5, 19.9 through 19.9.3, and 19.10 through 19.10.1.

The CVSS 3.1 base score of 7.5 indicates a high severity, driven by the lack of authentication, strong network access (AV:N), and low effort to attack (AC:L). The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw over the public or internal network via HTTP, making the risk of exploitation high if the system is exposed without proper network segmentation or access controls.