Primavera Unifier CVE-2026-101736

Exploitation targets the Core component of Oracle Primavera Unifier versions 21.12.0 through 21.12.17, reachable over the network via HTTP. Per the CVSS vector, no authentication (PR:N) and no user interaction (UI:N) are required. The key limiting factor is high attack complexity (AC:H / Oracle 'difficult to exploit'): success depends on conditions outside the attacker's direct control, so reliable exploitation is not guaranteed and likely requires specialized knowledge or specific environmental/timing prerequisites. Oracle's advisory does not name a specific enabling feature or non-default configuration; instances must simply be running an affected 21.12.x version and be network-reachable over HTTP. There is no availability impact (A:N), so this is a confidentiality/integrity-focused data exposure and tampering risk rather than a service-disruption flaw.

This is a genuine but second-tier priority. The CVSS 3.1 base score of 7.4 (High) is driven by network attack vector (AV:N), no privileges required (PR:N), and no user interaction (UI:N), combined with High confidentiality AND integrity impact (C:H/I:H) - an unauthenticated remote attacker can read and alter all Primavera Unifier-accessible data. The single most important mitigating signal is AC:H (high attack complexity), reflecting Oracle's own 'difficult to exploit' language; successful attack likely requires specific non-deterministic conditions, a race, or specialized knowledge, which materially lowers real-world exploitability. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no POC was supplied, so there is no public exploit identified at time of analysis. The signals are internally consistent (no conflict between vector and description), but the Oracle-only sourcing means independent corroboration is absent. Net: patch during the normal Oracle CPU cycle; the AC:H and lack of availability impact (A:N) make this lower-urgency than a wormable or actively exploited flaw, despite the 7.4 rating. Note: the input 'Authentication Bypass' tag is not substantiated by the description, which describes an unauthenticated flaw rather than a bypass of an authentication control - treat that label with caution.

A remote unauthenticated attacker with HTTP access to an internet- or network-reachable Primavera Unifier instance sends crafted requests that exploit a flaw in the Core component to read and modify project data without logging in. Because attack complexity is High, the attacker must satisfy specific conditions (e.g., timing or environmental prerequisites) to succeed reliably. No public exploit code was identified at time of analysis.