Description
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Logging). Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and 25.12.0-25.12.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access
Action: Patch Immediately
AI Analysis

Impact

A flaw in the logging component of Oracle Primavera Unifier allows an attacker with low user privileges to read sensitive data stored on the system. The vulnerability is rooted in improper access controls around the logging functionality, which permits unauthorized read operations. Successful exploitation results in the disclosure of confidential information held by the Primavera Unifier suite.

Affected Systems

Oracle Primavera Unifier versions 21.12.0 through 21.12.17, 22.12.0 through 22.12.15, 23.12.0 through 23.12.16, 24.12.0 through 24.12.16, and 25.12.0 through 25.12.9 contain the vulnerable logging component.

Risk and Exploitability

The CVSS 3.1 base score of 6.5 grades the issue as medium severity, while the EPSS score of <1% indicates a very low exploitation probability. The public advisory, however, notes that the flaw is easily exploitable by a low‑privileged attacker who can reach the service via HTTP, implying that anyone with network access to the web endpoint may succeed. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on November 6, 2026 at 20:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Primavera Unifier patch that addresses the logging component flaw
  • Restrict network access to the Primavera Unifier web endpoint, limiting connections to trusted hosts or VPNs
  • Configure the logging component to enforce authentication and authorization controls, ensuring only authorized users can access log data

Generated by OpenCVE AI on November 6, 2026 at 20:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 06 Nov 2026 21:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege Logging Vulnerability Enables Unauthorized Data Access in Primavera Unifier

Fri, 06 Nov 2026 19:00:00 +0000

Type Values Removed Values Added
Title Primavera Unifier Logging Component Enables Low-Privilege Network Attacker Unauthorized Data Access
Weaknesses CWE-284

Fri, 06 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Wed, 21 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
Title Primavera Unifier Logging Component Enables Low-Privilege Network Attacker Unauthorized Data Access
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Logging). Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and 25.12.0-25.12.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle primavera Unifier
CPEs cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle primavera Unifier
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Primavera Unifier
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-06T15:56:30.076Z

Reserved: 2026-09-28T15:40:09.486Z

Link: CVE-2026-101475

cve-icon Vulnrichment

Updated: 2026-11-06T15:55:59.492Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:17:56.503

Modified: 2026-11-06T16:17:06.627

Link: CVE-2026-101475

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T21:00:16Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor