CVE-2026-101735 in Primavera Unifier
Summary
by MITRE • 10/21/2026
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control). Supported versions that are affected are 23.12.0-23.12.16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Project Control component of Oracle Primavera Unifier, a comprehensive project portfolio management solution widely used in construction and engineering sectors. The affected software versions span from 23.12.0 through 23.12.16, indicating that any deployment operating within this specific release range is susceptible to exploitation. This vulnerability represents a significant security risk because it allows for the compromise of critical business data managed by the platform, which often includes sensitive financial records, project timelines, resource allocations, and contractual agreements essential for large-scale industrial operations.
The technical nature of this flaw centers on an authorization bypass or improper access control mechanism that permits low-privileged users to perform actions beyond their assigned permissions. Specifically, the vulnerability is easily exploitable by an attacker who possesses network access via HTTP and holds a valid but limited user account within the system. The absence of required user interaction further lowers the barrier for exploitation, allowing remote attackers to trigger the flaw without needing social engineering tactics or physical proximity. This characteristic aligns with common weaknesses found in web application frameworks where session management or role-based access control logic fails to properly validate permissions before executing sensitive operations on behalf of the authenticated user.
The operational impact of this vulnerability is severe due to its high integrity and confidentiality implications, as reflected by a CVSS 3.1 Base Score of 7.1. Successful exploitation enables an attacker to create, delete, or modify critical data within the Primavera Unifier environment. This capability threatens the structural integrity of project management workflows, potentially leading to corrupted datasets, lost historical records, or manipulated financial projections that could result in substantial monetary losses and compliance violations for affected organizations. Furthermore, the vulnerability grants unauthorized read access to a subset of accessible data, exposing confidential information such as proprietary designs, client details, or internal cost structures to potential adversaries. This dual impact on both confidentiality and integrity underscores the critical need for immediate remediation.
From a classification perspective, this vulnerability is best categorized under CWE-269 Improper Privilege Management or CWE-862 Missing Authorization, depending on whether the flaw stems from elevated privileges being granted incorrectly or standard permissions failing to restrict access appropriately. In terms of adversary tactics, it maps closely to MITRE ATT&CK techniques related to Account Manipulation and Data Staged for Exfiltration, as attackers often leverage such flaws to establish persistence or gather intelligence before executing more destructive actions. The network-based attack vector via HTTP indicates that the vulnerability is remotely exploitable over standard web protocols, making it particularly dangerous in environments where Primavera Unifier interfaces are exposed to internal networks or potentially external internet-facing endpoints if not properly segmented by firewalls and access control lists.
Mitigation strategies must prioritize immediate patching of all affected instances to version 23.12.17 or later, which contains the vendor's corrective code for this specific flaw. In scenarios where patching is temporarily delayed due to operational constraints, organizations should implement strict network segmentation to restrict HTTP access to the Primavera Unifier application servers only from trusted IP ranges and administrative workstations. Additionally, enforcing multi-factor authentication for all user accounts can mitigate the risk of credential theft leading to exploitation of this vulnerability. Security teams should also audit existing user roles and permissions to ensure that low-privileged accounts do not possess unnecessary write or delete capabilities on critical data objects, thereby reducing the blast radius in case a similar flaw is discovered in the future. Continuous monitoring for anomalous activity patterns, such as unusual spikes in data modification events by standard users, can provide early detection of exploitation attempts while preventive measures are being deployed.