Oracle Hospitality OPERA 5 CVE-2026-71106

The attacker must reach the Oracle Hospitality OPERA 5 web interface over HTTP via a network path (AV:N), which in many hotel deployments means the PMS is either intranet-only or, in some configurations, internet-facing. No authentication is required from the attacker (PR:N per CVSS). Critically, exploitation requires human interaction from a person other than the attacker (UI:R) - meaning a legitimate user, most likely hotel staff with an active session, must interact with attacker-controlled content (e.g., click a crafted link, load a page, or trigger a request). Exploitation is limited to versions 5.6.28.0 and 5.6.28.1 specifically; other OPERA 5 versions are not confirmed affected. The UI:R requirement means fully automated, unsolicited exploitation is not possible - the attacker must successfully deliver and trigger a user-interaction step, such as phishing hotel staff.

The CVSS 3.1 base score of 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a high-severity, network-accessible vulnerability with no authentication requirement and low complexity, offset only by the need for human interaction (UI:R). The full C:H/I:H/A:H triple confirms complete system takeover as the worst-case outcome, which Oracle's advisory characterizes explicitly as 'takeover of Oracle Hospitality OPERA 5 Property Services.' No EPSS score is available in the provided data, and the vulnerability is not listed in CISA KEV, meaning automated or broad active exploitation has not been confirmed by authoritative sources. The UI:R requirement is a meaningful but not prohibitive friction factor - social engineering targeting hotel front-desk or IT staff with active PMS sessions is a realistic and historically observed threat model in the hospitality sector. The narrow affected version band (5.6.28.0-5.6.28.1) somewhat limits blast radius, but any unpatched installation running these versions should be treated as critically exposed. The 'Information Disclosure' tag reported alongside this CVE may understate actual impact given the full CIA compromise described in the CVSS vector - this discrepancy should be noted and the vendor advisory consulted for clarification.

An attacker crafts a malicious HTTP link or payload targeting the Opera Servlet endpoint and delivers it to a hotel staff member - for example, via a phishing email disguised as a legitimate hotel system notification. When the staff member clicks the link or loads the content in their browser while authenticated to the OPERA 5 PMS, the attacker's payload executes within the application context, resulting in full compromise of the property management system. No public proof-of-concept exploit has been identified at time of analysis.