EUVD-2026-33036
GHSA-g89r-3vv2-wxjx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed OPERA HTTP endpoint
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitTrigger vulnerability in Property Services
-
ExecutionAchieve service takeover
-
PersistExfiltrate guest and payment data
-
ImpactPivot into hospitality network
Vulnerability Assessment
| Exploitation Conditions | Network reachability to the OPERA 5 Property Services HTTP interface on an affected build (5.6.19.24, 5.6.22, 5.6.25.19, 5.6.27.6, or 5.6.28) is the only prerequisite - CVSS PR:N and UI:N confirm no authentication and no user interaction are required, and AC:L confirms no special timing or configuration conditions. Limiting factors are deployment-driven rather than vulnerability-driven: OPERA 5 is typically deployed on internal hotel networks rather than directly on the public internet, so real-world exploitability depends on whether the management HTTP port is exposed beyond the property LAN, reachable via VPN/partner connections, or accessible to a foothold inside the hotel network. |
| Impact | All available signals point to high real-world risk: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates an internet- or network-reachable, low-complexity, no-authentication, no-user-interaction path to full confidentiality, integrity, and availability compromise, and Oracle itself describes it as 'easily exploitable.' However, EPSS score and KEV status were not provided in the input, and no public PoC reference is present, so the practical exploitation timeline is uncertain - this is a 'high CVSS, unknown active-exploitation' profile that should still be prioritized given OPERA's exposure in the hospitality sector and historical attacker interest in PMS systems for payment and guest-data theft. The 'Information Disclosure' tag is narrower than the CVSS impact metrics (which include I:H and A:H), suggesting the tag is incomplete; treat the CVSS vector as authoritative. |
| Exploit ScenarioDerived | An attacker who can reach an OPERA 5 Property Services HTTP listener - for example via a flat hotel network, exposed management interface, or compromised vendor VPN - sends a single crafted HTTP request to a vulnerable endpoint and gains full control of the service without credentials or user interaction. From there, the attacker can read guest PII and payment-related data, modify reservations and folios, and pivot deeper into the hospitality network. No public exploit is identified at time of analysis, but Oracle's 'easily exploitable' wording suggests low engineering effort to weaponize. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 28, 2026
Remote takeover of Oracle Hospitality OPERA 5 Property Services (versions 5.6.19.24, 5.6.22, 5.6.25.19, 5.6.27.6, and 5.6.28) is achievable by unauthenticated network attackers over HTTP, per Oracle's May 2026 CPU. With CVSS 9.8 and full CIA impact, this is a critical hospitality-sector exposure, though no public exploit is identified at time of analysis and KEV status is not present. EPSS data was not supplied, so probability-of-exploitation cannot be quantified.
RemediationAI
Apply the fixes delivered in Oracle's May 2026 Critical Patch Update for Oracle Hospitality Applications, documented at https://www.oracle.com/security-alerts/cspumay2026.html; exact patched build numbers are listed in that advisory and should be cited directly from it rather than inferred. Until patching is complete, restrict network reachability of OPERA 5 Property Services HTTP endpoints to trusted management VLANs and front-desk subnets via firewall ACLs, place the service behind an authenticating reverse proxy or VPN, and enable WAF rules in front of the OPERA web tier - noting that filtering may break legitimate integrations with PMS connectors, channel managers, and POS systems, so test integration paths after enabling controls. Monitor HTTP access logs for unauthenticated requests to administrative or integration URIs as a detection compensator.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OPERA 5 Property Services is Oracle Hospitality's on-premises property management system (PMS) widely deployed by hotels and hospitality operators to manage reservations, guest profiles, billing, and front-desk operations, identified by CPE cpe:2.3:a:oracle_corporation:oracle_hospitality_opera_5_property_services. The advisory does not assign a CWE, but the combination of network-reachable HTTP attack surface, lack of authentication, and 'takeover' outcome typically corresponds to weaknesses such as authentication bypass, deserialization, or injection in the application's web tier. Because OPERA exposes management and integration interfaces over HTTP, any input-handling defect in those endpoints can translate directly into full service compromise.
Know when Oracle Hospitality Opera 5 Property Services gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). Supported versions that are affected are 5.6.19.24, 5.6.22, 5.6.25.19, 5.6.27.6 and 5.6.28. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Hospitality OPERA 5 Property Services (versions 5.6.19.24-5.6.28) is vulnerable to unauthenticated remote system compromise over HTTP, creating immediate operational and data protection risk for hospitality organizations operating these versions. With no vendor patch available and full impact to confidentiality, integrity, and availability, affected properties face guest data exposure and service disruption. This is a critical threat requiring immediate network isolation and access controls pending patch release.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict HTTP/network access to OPERA 5 systems via firewall rules, limiting connections to trusted administrative networks only; (2) Deploy network-based intrusion detection for exploitation attempts once vendor signatures are published; (3) Enable enhanced logging and real-time alerting for OPERA 5 process anomalies and unauthenticated connection attempts; (4) Consider air-gap or network segmentation of non-critical properties to reduce exposure surface. Compensating controls significantly reduce but do not eliminate risk-vendor patch or system upgrade must be prioritized as first-order remediation within 30 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB