CVE-2026-71106
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Vulnerability in Oracle Hospitality OPERA 5 Property Services (component: Opera Servlet). Affects versions 5.6.28.0-5.6.28.1. Easily exploitable, requires user interaction, allows unauthenticated attacker via HTTP to take over system. CVSS 8.8.
Risk Assessment
Attack can lead to full takeover of OPERA 5, risking confidentiality, integrity, and availability of hotel data.
Recommendation
Apply Oracle patches for versions 5.6.28.0-5.6.28.1. Educate users about risks of interacting with suspicious content.
Other vulnerabilities in Oracle Hospitality OPERA 5 Property Services
See all- CVE-2017-3574High
Vulnerability in the OPERA 5 Property Services component of Oracle Hospitality Applications allows low privileged attackers to access critical data. Versions 5.4.0.x, 5.4.1.x, 5.4.2.x, 5.4.3.x, 5.5.0.x, and 5.5.1.x are susceptible to easily exploitable attacks via HTTP.
- CVE-2016-5565High
Unspecified vulnerability in the OPERA 5 Property Services component in Oracle Hospitality Applications 5.4.0.0 through 5.4.3.0, 5.5.0.0, and 5.5.1.0 allows remote authenticated users to affect confidentiality via vectors related to OPERA.
- CVE-2016-5564High
Unspecified vulnerability in the OPERA 5 Property Services component in Oracle Hospitality Applications 5.4.0.0 through 5.4.3.0, 5.5.0.0, and 5.5.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability.
- CVE-2016-5563High
Unspecified vulnerability in the OPERA 5 Property Services component in Oracle Hospitality Applications 5.4.0.0 through 5.4.3.0, 5.5.0.0, and 5.5.1.0 allows remote administrators to affect confidentiality, integrity, and availability via vectors related to OPERA.
Original NVD description (English source)
Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.28.0-5.6.28.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS