Description
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access to and modification of critical project data
Action: Apply patch
AI Analysis

Impact

The vulnerability exists within the Web Access component of Oracle’s Primavera P6 Enterprise Project Portfolio Management. An attacker who can reach the system over HTTP and has low privileges can, with the cooperation of an authorized user, manipulate the application to gain elevated access. Successful exploitation allows read access to sensitive project data and the ability to insert, update, or delete records, compromising confidentiality and partially impacting data integrity.

Affected Systems

Oracle Corporation’s Primavera P6 Enterprise Project Portfolio Management is affected. All supported releases from 21.12.0.0 through 21.12.21.9, 22.12.0.0 through 22.12.21.4, 23.12.0 through 23.12.20, 24.12.0 through 24.12.16, and 25.12.0 through 25.12.8 are vulnerable.

Risk and Exploitability

The CVSS 3.1 base score of 6.5 classifies the flaw as medium severity. The exploitation path requires remote network access via HTTP, low attacker privileges, and a human interaction step, which reduces but does not eliminate the likelihood of attack. The vulnerability’s scope change may extend its impact to other products. It is not currently listed in the CISA KEV catalog, so no additional mitigation directives are available from U.S. authorities at this time.

Generated by OpenCVE AI on October 21, 2026 at 09:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle’s latest security patch or upgrade to a Primavera P6 version newer than 25.12.8.
  • Restrict network access to the Primavera P6 Web Access interface to trusted IP ranges or VPN endpoints.
  • Enforce strict role‑based access control and audit user privileges to ensure least privilege for all accounts.

Generated by OpenCVE AI on October 21, 2026 at 09:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 09:45:00 +0000

Type Values Removed Values Added
Title Remote Privilege Escalation and Data Exposure via Human Interaction in Primavera P6 Web Access
Weaknesses CWE-269
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N).
First Time appeared Oracle
Oracle primavera P6 Enterprise Project Portfolio Management
CPEs cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle primavera P6 Enterprise Project Portfolio Management
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N'}

Subscriptions

Oracle Primavera P6 Enterprise Project Portfolio Management
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T15:43:28.506Z

Reserved: 2026-09-14T22:10:16.631Z

Link: CVE-2026-91376

cve-icon Vulnrichment

Updated: 2026-10-21T15:43:10.997Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:40.650

Modified: 2026-10-21T18:45:11.277

Link: CVE-2026-91376

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T19:00:06Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control