An unauthenticated remote vulnerability in Oracle Hospitality Simphony enables an attacker with network access to the HTTP interface to retrieve critical data. The flaw requires no credentials and can be leveraged simply by sending a crafted request over the network. Upon exploitation, the attacker can read information exposed by the application, resulting in a confidentiality compromise without affecting integrity or availability.

Oracle Hospitality Simphony, part of Oracle Food and Beverage Applications, is affected in the following supported versions: 19.8 through 19.8.5, 19.9 through 19.9.3, and 19.10 through 19.10.1.

The CVSS 3.1 base score of 7.5 indicates a high severity, driven by the lack of authentication, strong network access (AV:N), and low effort to attack (AC:L). The EPSS score of < 1% reflects a very low probability of exploitation, while the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw over the public or internal network via HTTP, making the risk of exploitation high if the system is exposed without proper segmentation or access controls.