CVE-2026-71106

HighCVSS 8.8

Published: 18/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

32th percentile - higher than 32% of all known CVEs

Summary

Vulnerability in Oracle Hospitality OPERA 5 Property Services (component: Opera Servlet). Affects versions 5.6.28.0-5.6.28.1. Easily exploitable, requires user interaction, allows unauthenticated attacker via HTTP to take over system. CVSS 8.8.

Risk Assessment

Attack can lead to full takeover of OPERA 5, risking confidentiality, integrity, and availability of hotel data.

Recommendation

Apply Oracle patches for versions 5.6.28.0-5.6.28.1. Educate users about risks of interacting with suspicious content.

Original NVD description (English source)

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.28.0-5.6.28.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).