CVE-2026-34311

critical · 9.8

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). Supported versions that are affected are 5.6.19.24, 5.6.22, 5.6.25.19, 5.6.27.6 and 5.6.28. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

9.8

CVSS

0.5%

EPSS (exploit prob.)

39th

EPSS percentile

2026-05-28

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Affected versions
oracle	hospitality_opera_5_property_services	5.6.19.24
oracle	hospitality_opera_5_property_services	5.6.22
oracle	hospitality_opera_5_property_services	5.6.25.19
oracle	hospitality_opera_5_property_services	5.6.27.6
oracle	hospitality_opera_5_property_services	5.6.28

Check a specific version with /api/v1/cve/match.

References

https://www.oracle.com/security-alerts/cspumay2026.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-34311