The vulnerability exists in the Oracle Hospitality Simphony POS component. An unauthenticated attacker with network access via HTTP can compromise the system, allowing the attacker to create, delete, or modify critical data. The flaw also enables an attacker to cause the system to hang or repeatedly crash, resulting in a complete denial of service. The CVSS vector indicates the attack requires network access, no authentication, and no user interaction, with high integrity and availability impacts.

The affected product is Oracle Hospitality Simphony, versions 19.8‑19.8.5, 19.9‑19.9.3, and 19.10‑19.10.1 from Oracle Corporation.

The CVSS base score of 9.1 signifies high severity. No EPSS score is publicly available, and the vulnerability is not yet listed in the CISA KEV catalog. The attacker only needs network connectivity to the POS HTTP interface; authentication is not required. Given the absence of known exploit data, the likelihood of exploitation remains uncertain, but the potential impact on data integrity and system availability is substantial.