Oracle Hospitality Opera 5 vulnerabilities

10 CVEs affecting Oracle Hospitality Opera 5, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-21967, published 2026-01-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-17530: Apache Struts Remote Code Execution Vulnerability, published 2020-12-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 95.9% chance of exploitation in the next 30 days. Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
CVE-2019-10086, published 2019-08-20. High severity, CVSS 7.3. EPSS: 28.4% chance of exploitation in the next 30 days. In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all…
CVE-2018-1285, published 2020-05-11. Critical severity, CVSS 9.8. EPSS: 17.8% chance of exploitation in the next 30 days. Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled…
CVE-2019-17566, published 2020-11-12. High severity, CVSS 7.5. EPSS: 10.9% chance of exploitation in the next 30 days. Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this…
CVE-2021-2351, published 2021-07-21. High severity, CVSS 8.3. EPSS: 2.4% chance of exploitation in the next 30 days. Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows…
CVE-2020-17521, published 2020-12-07. Medium severity, CVSS 5.5. EPSS: 1% chance of exploitation in the next 30 days. Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method…
CVE-2025-21547, published 2025-01-21. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.19.20, 5.6.25.8, 5.6.26.6 and …
CVE-2024-21172, published 2024-10-15. Critical severity, CVSS 9.0. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.19.19, 5.6.25.8 and 5.6.26.4.…
CVE-2026-21967, published 2026-01-20. High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.19.23, 5.6.25.17, 5.6.26.10 and …
CVE-2026-21966, published 2026-01-20. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). Supported versions that are affected are 5.6.19.23, 5.6.25.17,…