This vulnerability affects the Opera Servlet component of Oracle Hospitality OPERA 5 Property Services versions 5.6.28.0 to 5.6.28.1. An unauthenticated attacker with network access via HTTP can exploit this flaw, but exploitation requires user interaction from a third party. Successful exploitation can lead to full compromise of the Oracle Hospitality OPERA 5 Property Services, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

If exploited, this vulnerability can result in complete takeover of Oracle Hospitality OPERA 5 Property Services, severely affecting confidentiality, integrity, and availability of the service. The attack requires human interaction from a user other than the attacker, which may limit automated exploitation but still poses a significant risk.

Oracle has released a Critical Security Patch Update including fixes for this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Staying on actively-supported versions and applying patches without delay is recommended. Refer to the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions.