Primavera P6 CVE-2026-91376

Requires the attacker to already possess a low-privileged authenticated account on the Primavera P6 Enterprise Web Access component (PR:L), network/HTTP reachability to that interface (AV:N), and - critically - interaction from a separate human victim other than the attacker (UI:R), typically a higher-privileged user who views or acts on attacker-supplied content. Exploitation is further limited by high attack complexity (AC:H), implying dependence on specific timing, configuration, or conditions outside the attacker's direct control. The scope change (S:C) means impact can extend into additional connected Oracle products beyond P6 itself. Limiting factors for defenders: valid credentials are mandatory, a second human must be socially engineered into interacting, and the flaw is explicitly rated difficult to exploit - so internet-exposed or multi-tenant P6 Web Access instances with many user accounts are the realistic risk surface.

This is a moderate-severity (CVSS 3.1 base 6.5), moderate-real-risk issue that does not rise to emergency-patch priority on current signals. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N) describes a network-reachable but hard-to-exploit flaw: the attacker must already hold a low-privileged account (PR:L), overcome high attack complexity (AC:H), and depend on interaction from a separate human victim (UI:R) - three compounding barriers that argue against opportunistic, automatable mass exploitation. The scope change (S:C) plus high confidentiality impact (C:H) is the serious part: a successful attack can pivot beyond Primavera into additional products and expose all P6-accessible data, with limited integrity impact (I:L) and no availability impact (A:N). No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no public exploit code was provided, so there is no evidence of active exploitation. One signal conflicts with the data: the input carries an 'Authentication Bypass' tag, but the description explicitly requires a 'low privileged attacker' (PR:L) plus victim interaction - this is not an authentication bypass and the tag appears mislabeled, which could distort automated triage. Treat this as a scheduled-patch item for exposed/multi-tenant P6 Web Access deployments rather than a drop-everything emergency.

A low-privileged but legitimate P6 Web Access user plants a crafted payload (consistent with UI:R and scope change, this behaves like a stored cross-site/injection issue) and lures a higher-privileged colleague into viewing it over HTTP. When that victim interacts, the payload executes in their authenticated context, exposing critical data and pivoting into connected products. No public exploit code was provided, and high attack complexity makes reliable exploitation non-trivial.