PT-2026-3714 · Oracle · Oracle Hospitality Opera 5

Johnathan Law · Published 2026-01-20 · Updated 2026-01-21 · CVE-2026-21967

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Oracle Hospitality OPERA 5 versions 5.6.19.23 through 5.6.27.4

Description An easily exploitable issue exists in the Oracle Hospitality OPERA 5 product, specifically within the Opera Servlet component. An unauthenticated attacker with network access via HTTP can compromise the system. Successful exploitation may lead to unauthorized access to critical data, complete access to all accessible data, unauthorized data manipulation (update, insert, or delete), and a partial denial of service.

Recommendations Oracle Hospitality OPERA 5 version 5.6.19.23 should be updated. Oracle Hospitality OPERA 5 version 5.6.25.17 should be updated. Oracle Hospitality OPERA 5 version 5.6.26.10 should be updated. Oracle Hospitality OPERA 5 version 5.6.27.4 should be updated.

Fix

Related Identifiers

CVE-2026-21967

Affected Products

Oracle Hospitality Opera 5

References · 5

• https://oracle.com/security-alerts/cpujan2026.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21967 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21967 · Vendor Advisory
• https://twitter.com/CVEnew/status/2013782992976781675 · Twitter Post
• https://twitter.com/CveFindCom/status/2013743240634130590 · Twitter Post