EUVD-2026-106136
GHSA-5qpx-rggp-c9jr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
ExploitSend crafted HTTP request to Project Control
-
ExecutionBypass authorization checks
-
ImpactCreate/modify/delete critical data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid, authenticated low-privilege account on the target Primavera Unifier instance (CVSS PR:L) with network HTTP access to the Project Control component; affected builds are 23.12.0 through 23.12.16. No user interaction, non-default configuration, or victim action is needed (UI:N, AC:L). The primary limiting factor is the authentication prerequisite - an attacker must already possess or obtain application credentials - so exposure is bounded by how broadly the application is network-accessible and how account provisioning is controlled; purely external unauthenticated actors cannot exploit this directly. |
| Impact | This is a genuine but mid-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, 7.1 HIGH) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with the dominant impact being high integrity (unauthorized create/delete/modify of critical data) plus low confidentiality (partial read); availability is unaffected. No EPSS score, CISA KEV listing, POC, or SSVC decision point was supplied, so exploitation probability and automatability cannot be quantified from the input - treat the absence of KEV/POC as 'no evidence of exploitation yet,' not as proof of safety. A notable signal conflict exists: the input tag 'Authentication Bypass' contradicts the CVSS vector, which specifies PR:L (a valid, already-authenticated low-privilege account is required) - this is NOT an unauthenticated auth-bypass, and the tag should be treated as suspect pending vendor confirmation. Net: credible authenticated-attacker integrity risk warranting prompt patching where Primavera Unifier is internet- or broadly-network-exposed, but not an emergency drop-everything issue absent exploitation evidence. |
| Exploit ScenarioDerived | A low-privileged user with an existing Primavera Unifier account (versions 23.12.0-23.12.16) sends crafted HTTP requests to the Project Control component to perform actions beyond their authorization, creating, altering, or deleting critical project data and reading a subset of otherwise restricted data. No user interaction or additional privilege escalation is needed given PR:L/UI:N. No public exploit code was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Low-privileged authenticated users of Oracle Primavera Unifier 23.12.0 through 23.12.16 can create, delete, or modify critical Project Control data, and read a subset of application data, by sending HTTP requests to the Project Control component - no user interaction or special configuration is required. Scoring 7.1 on CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), the practical barrier is obtaining a valid low-privilege account rather than defeating authentication, which bounds exposure to instances reachable over the network with loosely controlled account provisioning. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; this is a genuine but mid-tier priority that warrants patching on the normal Oracle CPU cadence.
RemediationAI
Apply the fix delivered in Oracle's October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html) to any Primavera Unifier instance running 23.12.0 through 23.12.16; Oracle CPU patches are cumulative, so deploying the current 23.12.x CPU bundle resolves this along with other fixes in the same release, and it should be validated in a staging environment first because Unifier CPU bundles also touch schema and middleware components. Patch status is 'Patch available per vendor advisory' - an exact fixed build number was not included in the supplied data, so confirm the target build against the advisory matrix before closing the finding. Until patched, the most effective compensating control is to constrain who can reach the Project Control HTTP endpoints at all: place Unifier behind VPN or an allow-listed reverse proxy and restrict internet-facing exposure, at the cost of blocking legitimate remote contractors and mobile users who rely on direct access. In parallel, audit and tighten account provisioning and role assignment, since exploitation requires a valid low-privileged account (PR:L) - revoke dormant accounts, enforce MFA at the identity provider, and remove unnecessary Project Control privileges, accepting some administrative overhead and possible onboarding delays. Add monitoring or SIEM alerting on anomalous bulk create/delete/modify operations and unusual read patterns in Project Control for low-privilege roles, as these map directly to the I:H/C:L impact profile; log-based detection is a detective, not preventive, control and will not stop a determined insider with legitimate credentials.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Primavera Unifier is Oracle Construction and Engineering's project lifecycle, cost, and contract management platform, and the Project Control component handles the scheduling, budgeting, and change-management records that drive those workflows. The vulnerability is a server-side authorization enforcement gap: the assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) describes an attacker who already holds a legitimate low-privileged account performing operations against Project Control that are not properly restricted to their role, yielding high integrity impact (arbitrary creation, deletion, or modification of critical or all accessible Unifier data) and limited confidentiality impact (read access to a subset of data). Notably, no CWE mapping was supplied by the vendor and the impact profile is consistent with an improper-access-control / missing-authorization-check class rather than a memory-safety or injection defect. Intelligence feeds tag this record as an 'Authentication Bypass,' but that label conflicts with the authoritative CVSS vector's PR:L prerequisite; the tag should be treated as a feed artifact until Oracle's advisory text confirms otherwise, and defenders should plan on the authenticated-attacker model. Because exploitation is pure HTTP over the standard application interface, no client-side component, victim action, or scope change is involved.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network HTTP reach and low complexity (AV:N/AC:L); a low-privilege account is required (PR:L, not PR:N) with no user interaction; high integrity, partial confidentiality, no availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control). Supported versions that are affected are 23.12.0-23.12.16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Executive ViewAI
Oracle Primavera Unifier versions 23.12.0 through 23.12.16 contain a high-severity flaw that lets any authenticated low-privileged user alter or delete critical Project Control data and read a limited subset of application data without user interaction. Because no vendor-released patch is identified at time of analysis, leadership should treat this as a project data-integrity and delivery risk for teams using Unifier, especially where account provisioning or network exposure is loosely controlled. Exposure is bounded by the need for a valid account and network reachability, but the potential to corrupt project controls warrants prioritized containment and monitoring.
No vendor-released patch identified at time of analysis; restrict network access to Primavera Unifier Project Control endpoints, enforce least-privilege and timely deprovisioning of low-privileged accounts, enable and monitor audit logs for Project Control create/delete/modify actions, alert on anomalous changes, verify backup and restore capability, and segment or remove internet-facing instances where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB