Oracle Hospitality OPERA 5 CVE-2026-34311: Brief Summary of a Critical Unauthenticated Takeover Vulnerability

Introduction

An unauthenticated attacker with nothing more than HTTP access to an Oracle Hospitality OPERA 5 Property Services instance can take over the entire system, and with it the guest data, reservation records, and payment information stored in one of the hospitality industry's most widely deployed property management systems. CVE-2026-34311 carries a CVSS 3.1 base score of 9.8 and affects five supported versions in the 5.6.x release family, so it is relevant to a significant portion of the global OPERA 5 installed base.

Oracle Hospitality OPERA is the dominant property management system (PMS) in the hotel industry, and IDC named it a Leader in the IDC MarketScape: Worldwide Hospitality Property Management Systems 2025 Vendor Assessment. Its customers include major brands such as Hyatt, IHG Hotels and Resorts, Radisson, Sonesta, Omni, and Rotana. Oracle reported USD 6.7 billion in hospitality-related cloud revenue for fiscal 2025, and North America alone holds a projected 33.2% share of the global hotel management software market in 2026. A critical vulnerability in this product has implications for thousands of hotel properties and millions of guest records worldwide.

Technical Information

Vulnerability Characteristics

CVE-2026-34311 is a critical vulnerability in the Opera component of Oracle Hospitality OPERA 5 Property Services. It was published to the NVD on May 28, 2026, and Oracle addressed it in the May 2026 Critical Security Patch Update.

Oracle's description states: "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality OPERA 5 Property Services."

As of the publication date, the NVD has not assigned a CWE classification to this vulnerability, which limits automated classification. Security teams should categorize it manually based on the known attack pattern, which is unauthenticated remote takeover via HTTP.

CVSS Vector Breakdown

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which breaks down as follows:

The combination of AV:N, AC:L, PR:N, and UI:N is the worst possible attack surface profile. An attacker needs only network access to an OPERA 5 HTTP endpoint. Authentication, attack complexity, and user interaction put no barrier in the way.

Attack Surface Context from Prior OPERA 5 Vulnerabilities

Oracle's stated policy is not to disclose detailed vulnerability information in its Critical Patch Update advisories. Independent researchers have published several disclosures on the Opera component, though, and they show the attack surface where CVE-2026-34311 likely sits.

CVE-2023-21932 (Pre-Authentication RCE, CVSS 9.8): Security researchers from Assetnote showed that this vulnerability was an order-of-operations flaw: the product sanitized an encrypted payload before decrypting it. An attacker could therefore inject malicious content that bypassed sanitization entirely. The researchers published the Java file used to encrypt arbitrary strings, which made replication trivial. They achieved pre-authentication remote code execution by uploading a CGI web shell to the local file system. Oracle initially rated this vulnerability as "difficult to exploit" and requiring high privileges, but the independent researchers demonstrated it was exploitable without any authentication. Keep that gap between Oracle's severity assessment and actual exploitability in mind when evaluating CVE-2026-34311.

CVE-2026-21967 (SSRF with Credential Disclosure, CVSS v4.0 8.7): PwC's Dark Lab research team traced this flaw to the OperaServlet, where the callreport function takes the urladdress parameter and opens a direct URL connection to an attacker-specified address without validating it. The server sends internal state data to the attacker's server and leaks reusable database credentials (in dbuser/dbpswd@dbschema format) in plaintext. Those credentials give direct read/write access to the OPERA database via sqlplus.

CVE-2026-21966 (Reflected XSS, CVSS v4.0 5.1): Dark Lab identified a reflected XSS in the OperaPrint servlet within the OperaLogin.war module, where Utility.sanitizeParameterString sanitized the parameter value but left the parameter name unsanitized. The researchers got around browser URL encoding with an HTML entity bypass, placing the ' entity inside an onload attribute.

Inferred Attack Pattern

These precedents show that the Opera component's HTTP handling layer has systemic weaknesses in input validation and authentication enforcement. Each prior flaw exposed a different failure mode in the same component. CVE-2026-34311, with its 9.8 CVSS and "takeover" outcome, likely exploits a similar class of flaw, where attacker-controlled data reaches sensitive application logic before proper validation or authentication checks are applied. The breadth of affected versions across multiple release branches (5.6.19 through 5.6.28) indicates the vulnerability exists in core Opera component code shared across these versions.

Data at Risk

A successful takeover of Oracle Hospitality OPERA 5 exposes vast quantities of personally identifiable information, including guest names, emails, room allocations, and payment card data. Dark Lab demonstrated that CVE-2026-21967 alone gave direct read/write access to the OPERA database and exposed guest PII in bulk. A full system takeover via CVE-2026-34311 would provide even greater access, potentially including:

• Guest reservation data
• Payment card information, which triggers PCI DSS breach obligations
• Hotel operational systems, which would allow ransomware deployment
• Internal network pivoting, to enumerate and attack other hotel systems

Affected Systems and Versions

Five supported versions of Oracle Hospitality OPERA 5 Property Services are confirmed affected:

The vulnerability spans multiple release branches from 5.6.19 through 5.6.28, which indicates the flaw resides in core shared code within the Opera component. Any on-premises OPERA 5 installation running one of these versions is exposed. Organizations migrating to OPERA Cloud may have reduced exposure, but on-premises OPERA 5 deployments remain widespread across the hospitality industry.

With a customer base that includes Hyatt, IHG, Radisson, Sonesta, Omni, and Rotana, the potential blast radius spans thousands of hotel properties globally.

Vendor Security History

OPERA 5 Property Services has a track record of critical vulnerabilities, particularly in the Opera component:

Critical, unauthenticated vulnerabilities keep recurring in the Opera component across multiple CPU cycles, which suggests a systemic issue rather than isolated bugs. Oracle's policy of not disclosing vulnerability details makes this worse, because security teams cannot independently assess the true risk or build targeted compensating controls without third-party research.

Oracle has also historically underrated the severity of OPERA vulnerabilities. For CVE-2023-21932, Oracle's initial assessment described the flaw as difficult to exploit and requiring high privileges, and Assetnote's researchers then demonstrated it was trivially exploitable without any authentication. That history leaves open the possibility that CVE-2026-34311 is even more exploitable than its already critical 9.8 rating indicates.

More broadly, Oracle has patched record numbers of vulnerabilities in past CPU cycles. In some releases, more than half were remotely exploitable without authentication. One cycle included 40 vulnerabilities rated Critical and 25 with a CVSS score above 9.0.

References

• NVD: CVE-2026-34311
• Oracle Security Critical Patch Update Advisory, May 2026
• Arctic Wolf: CVE-2023-21932 Analysis
• Dark Lab: OPERA 5 Vulnerability Research (February 2026)
• NVD: CVE-2026-21966
• NVD: CVE-2024-21172
• Juniper Networks IPS Signature: HTTP:CTS:OPERA-PRE-AUTH-RCE
• HospitalityNet: Emerging Threats to Watch in 2026
• Oracle Hospitality IDC PMS MarketScape
• Oracle Hospitality OPERA Property Services
• GitHub Advisory: GHSA-wcg3-v8j6-c8gg
• SecurityWeek: Oracle Patches Record Number of Vulnerabilities
• CVEDetails: Oracle Hospitality Opera 5
• Oracle Critical Patch Updates Portal