Oracle OPERA PMS flaws: holes at the hotel front desk

Oracle OPERA, one of the most widely deployed property management systems in global hospitality, has carried major published vulnerabilities for years. The most striking, CVE-2018-2957, let a remote attacker with no account at all read everything the system could reach. Five years later, CVE-2023-22087 lets a low-privileged user take full control of OPERA 5.6. For hotel IT managers, the question is not whether these flaws exist but how long their instances stay behind on patches.

The conductor of the front desk

A PMS, or property management system, is the operational core of a hotel: arrivals and departures, guest profiles and contact details, rates, billing, and most interfaces to other systems, from connected door locks to in-room telephony. In French it is called a logiciel de gestion hôtelière. OPERA, published by Oracle Hospitality, is among the most common choices in international chains. A flaw at this layer is not a fringe module problem: it sits on the central register of the property's business.

CVE-2018-2957: reading everything without credentials

The NVD record published on July 18, 2018 describes a vulnerability in the Logging subcomponent of Oracle Hospitality OPERA 5 Property Services, version 5.5.x. It is rated easily exploitable: an unauthenticated attacker with network access over HTTP can compromise the product and gain complete access to all data reachable through OPERA. The CVSS 3.0 base score of 7.5 reflects total confidentiality impact. In hotel terms: reservations, names, contact details and stay records, over the network, with no username and no password.

Published the same day, CVE-2018-3014 hits the Reports subcomponent of the same 5.5.x line. It requires low privileges but likewise ends in complete access to all OPERA-accessible data, at a CVSS score of 6.5. Both records describe easily exploitable flaws on HTTP interfaces exposed to the network.

CVE-2023-22087: the takeover

On October 17, 2023, NVD published CVE-2023-22087, fixed in Oracle's October 2023 Critical Patch Update. This time the affected component is Opera itself, on version 5.6. A low-privileged network attacker, again over HTTP, can achieve takeover of Hospitality OPERA 5 Property Services. The CVSS 3.1 base score reaches 8.8, with confidentiality, integrity and availability all impacted. The classification adds a telling detail: CISA-ADP catalogs the flaw as CWE-306, Missing Authentication for Critical Function, meaning a critical function that simply lacks authentication.

The pattern across both eras is identical: software pieces designed for an internal property network, exposed over HTTP, with critical functions that skip authentication or settle for too little of it.

A documented risk, not a confirmed breach

No public case of CVE-2018-2957 exploited in the wild against a named hotel has been documented. These flaws therefore belong to the risk column, not the confirmed-breach column, and should be described as such. The booking-engine precedent argues against filing them away: Bitdefender's 2023 white paper on the IRM Next Generation engine by Resort Data Processing details successful intrusions that used vulnerabilities in that guest-facing software to capture guests' payment data through a malicious module attached to the web server. Same family of exposure, this time on the customer side.

What the patch cadence means in practice

Oracle ships security fixes on a quarterly rhythm, its Critical Patch Updates, and CVE-2023-22087 carries the mark of the October 2023 edition. For a hotel or portfolio IT manager, that cadence has concrete consequences.

An exact version inventory comes first: the NVD records cite OPERA 5 Property Services at 5.5.x and at 5.6, two release lines still present in real estates, and each CPU can touch more. Reviewing network exposure then outranks everything else: an OPERA HTTP interface, whether Logging, Reports or the application core, should never be reachable from the public internet, and that check deserves repeating after every infrastructure project or new vendor remote-access arrangement.

Each CPU should also be treated as an appointment rather than paperwork: subscribe to Oracle Hospitality advisories, validate third-party interface behavior in a staging environment before production rollout, and document the risk acceptance when a property must wait. Finally, the recurrence of CWE-306 class flaws argues for systematically auditing authentication on every interface the PMS exposes to integrations, connected door locks included, instead of assuming that internal access implies authorization. An unpatched PMS is not an incident by itself. It is a service door left open, and OPERA's history shows it can stay open for years.