CVE-2023-21932: Oracle Hospitality OPERA 5 OXI component flaw allows high-privileged data access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 7.2 with high confidentiality impact and scope change, plus a very high EPSS percentile, though exploitation requires high privileges and high complexity and no KEV listing exists.

What it is

CVE-2023-21932 is a vulnerability in the OXI component of Oracle Hospitality OPERA 5 Property Services, affecting version 5.6. It is described as difficult to exploit but allows a high-privileged attacker with network access via HTTP to compromise the product, with a scope change that can impact additional products. The record provides no root-cause detail (CWE is 'noinfo'), so the underlying flaw is unknown.

Impact

A successful attack can give unauthorized access to critical data or complete access to all OPERA 5 Property Services data, plus unauthorized update, insert or delete access to some data and a partial denial of service. Because scope changes, other products may also be significantly impacted.

Attack surface

Reachable over the network via HTTP (AV:N) with no user interaction (UI:N), but requires high privileges (PR:H) and is rated high attack complexity (AC:H). The record does not specify which interface or endpoint is involved.

Exploitation

Not listed in CISA KEV and no public exploit references are provided; only vendor advisories are cited. EPSS is high (0.44684, ~98.7th percentile), indicating elevated predicted exploitation likelihood despite the lack of confirmed in-the-wild activity.

What to do

• Apply the Oracle Critical Patch Update for April 2023 (cpuapr2023) to OPERA 5 Property Services 5.6.
• Restrict network access to the OXI/HTTP interface to trusted hosts and administrative networks.
• Review and minimize accounts with the high privileges required to reach the vulnerable component.
• Monitor for unexpected changes to OPERA data and for partial denial-of-service conditions.
• Confirm whether OPERA 5.6 is still supported and plan upgrade or compensating controls if not.

Detection

• Monitor HTTP requests to OPERA 5 Property Services from high-privileged accounts for anomalous or unexpected access patterns.
• Alert on unusual data modification or deletion activity in OPERA 5 Property Services.
• Track availability or partial denial-of-service events affecting the OPERA service.
• Correlate high-privileged account activity with network connections to the OXI interface.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.