Primavera Unifier EUVD-2026-105891

Exploitation requires the attacker to already possess a valid low-privileged account on the targeted Primavera Unifier instance (CVSS PR:L) and network HTTP access to the application; no user interaction and no elevated/admin privileges are needed. The flaw resides in the Logging component and yields confidentiality impact only (C:H, I:N, A:N), so it enables unauthorized reading of critical data but not modification or denial of service. Limiting factors: the authentication requirement rules out anonymous internet scanning-to-breach, and risk is concentrated where the application is network-exposed to semi-trusted or numerous low-privilege users; environments that restrict Unifier to trusted internal users face lower practical exposure.

This is a moderate-priority vulnerability that should not be treated as an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity attack requiring low privileges and no user interaction, yielding high confidentiality impact with no integrity or availability effect - a pure information-disclosure flaw against the Logging component. No EPSS score, KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this tempers the raw 6.5 score toward lower real-world urgency for most environments. One notable conflict: the input Tags include 'Authentication Bypass,' but the CVSS vector specifies PR:L (an already-authenticated low-privileged attacker), which is inconsistent with a true pre-authentication bypass - the tag appears mislabeled and should be verified against the Oracle advisory. Because this is an Oracle CPU-reported issue, exploit mechanics are deliberately sparse; the realistic priority is routine patching during the October 2026 CPU cycle rather than out-of-band response, with higher urgency only where Primavera Unifier is internet-exposed and handles sensitive construction/contract data.

An attacker who already holds a low-privilege Primavera Unifier account (or compromised such credentials) sends crafted HTTP requests to the application's Logging component to read data they are not authorized to access. Because attack complexity is low and no user interaction is needed, a single authenticated session can be abused to retrieve critical data across the application. No public exploit code is available, so exploitation would require independent research into the Logging component.