Primavera P6 EPPM CVE-2026-91399

Exploitation requires the attacker to already possess a valid low-privileged account on the Primavera P6 EPPM Web Access component and network HTTP/HTTPS reachability to that interface; per PR:L the attacker must be authenticated, so this is a post-login authorization/integrity flaw, not remote-unauthenticated. No user interaction (UI:N) and low complexity (AC:L) are needed once authenticated. Limiting factors: the account prerequisite means risk is concentrated in deployments with many or loosely-governed low-tier users, or where valid credentials can be obtained; impact is bounded to unauthorized modification of 'some' accessible data with no confidentiality or availability effect. Only the listed versions (21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16, 25.12.0-25.12.8) are affected.

This is a low-to-moderate priority issue, not a top-tier emergency. The CVSS 3.1 base score of 4.3 (MEDIUM) reflects a narrow impact: the vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N confirms network-reachable, low-complexity exploitation requiring an already-authenticated low-privileged account, with ONLY a low integrity impact (C:N, A:N) - meaning an attacker can perform some unauthorized update/insert/delete on a subset of application data, but cannot read confidential data or cause a denial of service. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV and no public POC is referenced, so there is no evidence of active or imminent exploitation. No SSVC decision data was supplied. The key tension in the data: the input Tags label this 'Authentication Bypass', but the CVSS vector requires PR:L (an authenticated low-privileged user) and the description explicitly says 'low privileged attacker' - these contradict a true authentication bypass, so the tag appears mislabeled and should not drive risk scoring. Net assessment: a genuine but limited post-authentication integrity flaw; prioritize behind any network-unauthenticated or high-impact Oracle CPU items, patch in the normal quarterly cycle.

An attacker who already holds a low-privileged Primavera P6 EPPM Web Access account sends crafted HTTP requests to the application to perform unauthorized update, insert, or delete operations against project data they should not be able to modify. Because attack complexity is low and no user interaction is needed, a single valid low-tier credential (or a compromised one) is sufficient. No public exploit code has been identified at time of analysis.