CVE-2026-101736
HighCVSS 7.4Summary
Vulnerability in Primavera Unifier (component Core) affecting versions 21.12.0-21.12.17. A difficult-to-exploit network attack via HTTP by an unauthenticated attacker can lead to unauthorized creation, deletion or modification and access to critical data.
Risk Assessment
May compromise integrity and confidentiality of project data, potentially disrupting project and construction management processes.
Recommendation
Update Primavera Unifier per Oracle guidance; restrict HTTP access and monitor data integrity.
Other vulnerabilities in Primavera Unifier
See all- CVE-2026-101735High
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control). Affected versions are 23.12.0-23.12.16. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to perform unauthorized creation, deletion or modification of critical data and read a subset of accessible data.
- CVE-2026-101475Medium
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Logging). A low privileged attacker with network access via HTTP can easily exploit this vulnerability, resulting in unauthorized access to critical data or complete access to all Primavera Unifier accessible data.
Original NVD description (English source)
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core). Supported versions that are affected are 21.12.0-21.12.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS