CVE-2026-34311: Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera)

Synopsis

A critical unauthenticated remote takeover vulnerability affects Oracle Hospitality OPERA 5 Property Services (versions 5.6.19.24, 5.6.22, 5.6.25.19, 5.6.27.6, and 5.6.28). The flaw is reachable over HTTP with no credentials required and no user interaction needed. Successful exploitation gives an attacker full control of the OPERA 5 service, including complete read, write, and availability impact across the system. No fix versions have been published yet; HarborGuard is tracking this advisory and will flag a patched rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the OPERA 5 HTTP service over the network; no local or physical access is required.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerable endpoint is fully unauthenticated.

• Victim interactionNot required

  The attack is entirely server-side and requires no action from any user or administrator.

• Attack complexityDetail

  The exploit is described as easily exploitable with no race conditions or special environmental prerequisites required.

Blast Radius

• A successful attacker reads all data accessible to the OPERA 5 service, including guest records, reservation details, and stored credentials.
• The attacker can write or modify persisted data across the service, including reservation state, billing records, and configuration.
• The attacker can crash or otherwise disable the OPERA 5 service, causing a full denial of hotel property management operations.
• Because the CVSS scope is unchanged, impact is contained to the OPERA 5 process and its directly accessible data, but full service takeover means all three pillars are compromised within that boundary.