CVE-2024-21014: Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: Simphony Enterprise Server). Supported versions…

PriorityP263critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.84%

53.7th percentile

Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: Simphony Enterprise Server). Supported versions that are affected are 19.1.0-19.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Simphony. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected

2 ranges

Vendor	Product	Version range	Fixed in
oracle	hospitality_simphony	19.1.0 – 19.5.4	—
oracle_corporation	hospitality_simphony	19.1.0 – 19.5.4	—

Detection & IOCsextracted from sources · hover to see the quote

→The vulnerability is remotely exploitable over HTTP with no authentication required (network access, no privileges, no user interaction), targeting Oracle Hospitality Simphony Enterprise Server versions 19.1.0–19.5.4. Monitor for anomalous unauthenticated HTTP requests to Simphony Enterprise Server endpoints. ↗
→Successful exploitation results in full system takeover (C/I/A all HIGH). Prioritize detection of unexpected process spawning, new admin account creation, or configuration changes on Simphony Enterprise Server hosts. ↗

·Only Oracle Hospitality Simphony versions 19.1.0 through 19.5.4 are confirmed affected. Versions outside this range are not listed as vulnerable. ↗
·The attack vector is network-based over HTTP; ensure Simphony Enterprise Server is not directly exposed to untrusted networks and that HTTP traffic to it is monitored or restricted. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vendor_oracle9.8CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.