Description

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.28.0-5.6.28.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:18:10.943Z",
  "pubdate": "2026-08-18T21:18:10.943Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Oracle Hospitality OPERA 5 Property Services product, specifically affecting the Opera Servlet component in supported versions 5.6.28.0 through 5.6.28.1. This security flaw allows an unauthenticated remote attacker with network access via the HTTP protocol to compromise the targeted system entirely.\nSuccessful exploitation of this vulnerability results in the complete takeover of Oracle Hospitality OPERA 5 Property Services, yielding high impacts across confidentiality, integrity, and availability. The CVSS 3.1 base score is rated at 8.8, reflecting the severe nature of the potential compromise.\nAlthough the vulnerability allows unauthenticated access and can be exploited over the network with low attack complexity, successful execution strictly requires human interaction from a victim other than the attacker, such as tricking a user into interacting with a malicious link or crafted request.\nGiven the enterprise nature of Oracle Hospitality applications and the potential for total application takeover, this vulnerability poses significant risk implications to business operations, guest data privacy, and core service availability. Organizations utilizing the affected software versions must prioritize remediation actions to prevent unauthorized administrative control.",
  "technicalDetails": "The vulnerability resides in the Opera Servlet component of Oracle Hospitality OPERA 5 Property Services versions 5.6.28.0 and 5.6.28.1. The root cause stems from insecure handling of incoming HTTP requests processed by the servlet, allowing malicious payloads to manipulate application logic or execute arbitrary commands within the context of the service.\nAttackers can leverage network exposure via the HTTP protocol to deliver the exploit payload. Because the attack vector is network-based (AV:N) and requires low attack complexity (AC:L), an external entity without prior authentication (PR:N) can target the vulnerable endpoint. However, the exploit mechanism mandates user interaction (UI:R), meaning an authenticated or visiting user must perform a specific action, such as clicking a malicious link, to trigger the payload delivery.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts a malicious HTTP request targeting the vulnerable Opera Servlet component. Second, the attacker induces the required human interaction by delivering the crafted request or link to a valid user of the system. Third, when the user interacts with the malicious payload, the request is processed by the Opera Servlet. Due to insufficient input validation or insecure deserialization/handling within the component, the payload executes successfully.\nUpon successful execution, the payload achieves a complete system takeover (S:U, C:H, I:H, A:H). The attacker gains full control over the confidentiality, integrity, and availability of the Oracle Hospitality OPERA 5 Property Services instance, enabling unauthorized data exfiltration, modification of critical system parameters, and denial of service conditions."
}