Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications

CVE-2026-34311 is an unauthenticated Server-Side Request Forgery (SSRF) in Oracle Hospitality OPERA 5 Property Services, the on-premise property management system used by hotels, resorts, and casino properties worldwide. The flaw lets a remote attacker with no credentials send crafted HTTP requests that the OPERA server will proxy on their behalf — reaching internal services, databases, and cloud metadata endpoints that should never be externally accessible. Oracle's own NVD description explicitly states the outcome is takeover of Oracle Hospitality OPERA 5 Property Services. Affected versions are 5.6.19.24, 5.6.22, 5.6.25.19, 5.6.27.6, and 5.6.28. The vulnerability was discovered by Alex Lee of PwC HK DarkLab and reported to Oracle on March 7, 2026, with a public patch released May 28, 2026.

Oracle's CRITICAL 9.8 rating is justified and, if anything, conservative in context. The CVSS vector — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — correctly reflects the zero-authentication, zero-interaction, network-reachable attack surface. Prior research (CVE-2023-21932) demonstrated that OPERA instances are routinely internet-exposed and trivially discoverable via Shodan. OPERA 5 sits at the nexus of PCI cardholder data, guest PII (passport numbers, loyalty profiles, billing addresses), and operational hotel systems. The only reason to shade the score down at all is the absence of confirmed in-the-wild exploitation and a low EPSS of 0.46%, but the technical writeup from DarkLab provides enough detail for a competent attacker to reproduce the chain.

Why this verdict

• Zero-friction entry point: AV:N/AC:L/PR:N/UI:N — no authentication, no user interaction, no special configuration required. This is the most permissive attack surface profile possible.
• Internet exposure is the norm, not the exception: Prior research on OPERA CVEs (CVE-2023-21932) demonstrated that OPERA instances are routinely internet-facing and trivially discoverable. The on-premise deployment model means patching depends on individual hotel IT teams, not a centralized SaaS operator.
• Data value multiplier: OPERA 5 is the system of record for guest PII (passport numbers, addresses, loyalty data) and payment card processing. A breach triggers PCI DSS incident response, regulatory notification across multiple jurisdictions, and brand damage. A single large resort property may hold 500K+ guest records.
• Role multiplier: OPERA 5 is deployed exclusively as the primary property management system — 100% of installs are in production hospitality roles handling regulated data. It is not a dev tool or optional component. The blast radius of a takeover is *mass data egress of PCI and PII data* plus *operational disruption* (reservations, check-in/out, billing). While OPERA is not in the canonical infrastructure high-value catalog (not a DC, hypervisor, or IdP), the *data-tier blast radius* — PCI cardholder data for an entire hotel chain — meets the 'mass data egress' threshold. The floor is HIGH; the zero-auth network attack surface pushes it to CRITICAL.
• Technical writeup available: DarkLab's blog post provides enough context for a skilled attacker to reproduce the SSRF chain. The gap between writeup and weaponized exploit is narrow for SSRF vulnerabilities.

Why not higher?

The score is already CRITICAL. The 0.4-point reduction from 9.8 to 9.4 reflects the absence of confirmed in-the-wild exploitation, no KEV listing, and a very low EPSS score (0.46%), which collectively suggest the vulnerability is not yet under active mass exploitation. The Scope metric is Unchanged, meaning the blast radius is bounded to the OPERA server's own authority rather than breaking into adjacent security domains automatically.

Why not lower?

Downgrading to HIGH would require evidence that internet exposure of OPERA is rare (<1% of deployments), but prior Shodan research shows the opposite — these systems are routinely internet-facing. The zero-authentication requirement eliminates the most common friction point that justifies downgrades. The data value (PCI, PII) means even a single successful exploitation has regulatory and financial consequences that dwarf typical server compromises.

1. Block internet access to OPERA 5 web interface immediately — Place OPERA behind a VPN, firewall allowlist, or reverse proxy that restricts access to authorized hotel staff and integration partners only. This eliminates the AV:N vector entirely. Deploy within 3 days per noisgate mitigation SLA for CRITICAL.
2. Deploy WAF rules to block SSRF patterns — Configure WAF (e.g., ModSecurity, Cloudflare, F5 ASM) to inspect and block requests containing internal IP ranges (10.x, 172.16-31.x, 192.168.x, 169.254.169.254) in user-controllable parameters hitting OPERA endpoints. This is defense-in-depth, not a substitute for patching. Deploy within 3 days.
3. Enforce IMDSv2 on cloud-hosted OPERA instances — If OPERA runs on AWS EC2, enforce IMDSv2 (token-required) to prevent SSRF-based metadata credential theft. Similar protections exist on Azure (managed identity with IMDS restrictions) and GCP. Deploy within 3 days.
4. Enable database audit logging on OPERA's Oracle DB — Turn on fine-grained auditing for SELECT on guest profile and payment tables. This won't prevent exploitation but ensures you detect data exfiltration and can scope a breach. Configure within 3 days.
5. Segment OPERA server network — Restrict the OPERA server's outbound network access to only the specific hosts and ports it needs (OXI integration endpoints, payment gateway, Oracle DB). Deny all other egress. This limits SSRF pivot capability.

Run this script on each OPERA 5 application server as a local administrator. It checks the installed OPERA version against the known-vulnerable list. Example: .\Check-CVE-2026-34311.ps1. No network access required.

#!/usr/bin/env pwsh
# Check-CVE-2026-34311.ps1
# Checks Oracle Hospitality OPERA 5 Property Services for CVE-2026-34311
# Run on the OPERA application server as local admin.
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'
$vulnerableVersions = @('5.6.19.24', '5.6.22', '5.6.25.19', '5.6.27.6', '5.6.28')

try {
    # Method 1: Check OPERA registry keys (common install path)
    $regPaths = @(
        'HKLM:\SOFTWARE\MICROS\OPERA',
        'HKLM:\SOFTWARE\Oracle\OPERA',
        'HKLM:\SOFTWARE\WOW6432Node\MICROS\OPERA',
        'HKLM:\SOFTWARE\WOW6432Node\Oracle\OPERA'
    )
    $operaVersion = $null
    foreach ($rp in $regPaths) {
        if (Test-Path $rp) {
            $operaVersion = (Get-ItemProperty -Path $rp -ErrorAction SilentlyContinue).Version
            if ($operaVersion) { break }
        }
    }

    # Method 2: Check OPERA config/version file if registry fails
    if (-not $operaVersion) {
        $configPaths = @(
            'C:\Micros\Opera\version.txt',
            'C:\Oracle\Opera\version.txt',
            'D:\Micros\Opera\version.txt',
            'D:\Oracle\Opera\version.txt'
        )
        foreach ($cp in $configPaths) {
            if (Test-Path $cp) {
                $content = Get-Content $cp -Raw
                if ($content -match '(\d+\.\d+\.\d+\.?\d*)') {
                    $operaVersion = $Matches[1]
                    break
                }
            }
        }
    }

    if (-not $operaVersion) {
        Write-Host 'UNKNOWN - Oracle OPERA 5 installation not detected on this host.'
        exit 2
    }

    Write-Host "Detected OPERA version: $operaVersion"

    if ($vulnerableVersions -contains $operaVersion) {
        Write-Host "VULNERABLE - OPERA version $operaVersion is affected by CVE-2026-34311."
        Write-Host 'ACTION: Apply Oracle CSPU May 2026 patch immediately.'
        exit 1
    } else {
        Write-Host "PATCHED - OPERA version $operaVersion is not in the known-vulnerable list."
        Write-Host 'NOTE: Verify the May 2026 CSPU was applied via Oracle patch inventory.'
        exit 0
    }
} catch {
    Write-Host "UNKNOWN - Error during check: $_"
    exit 2
}

Sources

1. NVD - CVE-2026-34311 Detail
2. PwC DarkLab HK - Critical Unauthenticated SSRF in Oracle Opera PMS
3. Cyber Security Agency of Singapore - Oracle Advisory
4. Oracle CSPU May 2026
5. 6sense - Oracle OPERA 5 Market Share
6. Dark Reading - Hotels at Risk from Oracle Property Management Bug
7. Rewterz - Oracle Patches 35 Critical Vulnerabilities