CVE-2026-101475
MediumCVSS 6.5Summary
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Logging). A low privileged attacker with network access via HTTP can easily exploit this vulnerability, resulting in unauthorized access to critical data or complete access to all Primavera Unifier accessible data.
Risk Assessment
A low-privileged attacker could gain access to critical data, potentially compromising confidentiality.
Recommendation
Update Primavera Unifier to the latest version and restrict network access to necessary addresses.
Other vulnerabilities in Primavera Unifier
See all- CVE-2026-101736High
Vulnerability in Primavera Unifier (component Core) affecting versions 21.12.0-21.12.17. A difficult-to-exploit network attack via HTTP by an unauthenticated attacker can lead to unauthorized creation, deletion or modification and access to critical data.
- CVE-2026-101735High
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control). Affected versions are 23.12.0-23.12.16. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to perform unauthorized creation, deletion or modification of critical data and read a subset of accessible data.
Original NVD description (English source)
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Logging). Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and 25.12.0-25.12.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS