CVE-2026-21966 Cross-site scripting in Oracle Hospitality OPERA 5 Property Services
Unauthenticated attackers can exploit this vulnerability to read and modify data in Oracle Hospitality OPERA 5 Property Services via HTTP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-21966?
CVE-2026-21966 is a medium-severity cross-site scripting vulnerability in Oracle Hospitality OPERA 5 Property Services, published on 20 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). Supported versions that are affected are 5.6.19.23, 5.6.25.17, 5.6.26.10 and 5.6.27.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Hospitality OPERA 5 Property Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hospitality OPERA 5 Property Services accessible data as well as unauthorized read access to a subset of Oracle Hospitality OPERA 5 Property Services accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Which versions are affected by CVE-2026-21966?
It affects 1 product.
Products include Oracle Hospitality Opera 5.
How do I fix CVE-2026-21966?
No fix has been published for CVE-2026-21966 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-21966 being exploited?
There is no known exploitation of CVE-2026-21966 in the wild and no public exploit code.
Other vulnerabilities in Oracle Hospitality OPERA 5 Property Services
Sources
Also known as GHSA-m2r3-gq7c-7p58.