CVE-2026-101736 in Primavera Unifier
Summary
by MITRE • 10/21/2026
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core). Supported versions that are affected are 21.12.0-21.12.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Core component of Oracle Primavera Unifier, a prominent project portfolio management solution utilized extensively in construction and engineering sectors. The affected software versions span from 21.12.0 through 21.12.17, representing a specific window of release where this security flaw is present. This vulnerability classifies as an authentication bypass issue that permits unauthenticated actors to interact with the application via standard HTTP protocols. Despite being categorized as difficult to exploit due to high complexity requirements for successful execution, the potential impact on system integrity and confidentiality remains severe. The absence of required authentication checks allows external threats to penetrate the perimeter without valid credentials, fundamentally undermining the access control mechanisms designed to protect sensitive project data.
From a technical perspective, this flaw represents a critical failure in input validation or session management logic within the Core module. Attackers can leverage network-accessible HTTP endpoints to trigger actions that should be restricted to authenticated users with appropriate privileges. The complexity involved likely stems from specific sequence requirements or state manipulation needed to bypass security controls, which may involve crafting precise requests that exploit race conditions or logical errors in how the application processes unauthenticated input. This aligns closely with CWE-287, Improper Authentication, where an actor is able to validate as a different user than they claim to be, or CWE-306, Missing Authentication for Critical Function, which describes scenarios where critical functions are accessible without proper verification of identity. The vulnerability allows the attacker to perform unauthorized operations that alter the state of the application and its underlying data stores.
The operational impact of this vulnerability is substantial, primarily affecting the confidentiality and integrity aspects of the CIA triad while leaving availability largely intact as indicated by the CVSS vector. Successful exploitation enables an unauthenticated attacker to create, delete, or modify critical data within the Primavera Unifier environment. This capability extends beyond isolated records to potentially encompass all accessible data within the system's scope. Consequently, sensitive project information, financial details, resource allocations, and contractual documents could be exposed to unauthorized parties or altered maliciously. Such breaches can lead to significant operational disruptions, legal liabilities due to non-compliance with data protection regulations, and erosion of trust among stakeholders who rely on the integrity of the project management platform. The ability to modify critical data poses a direct threat to business continuity and decision-making processes that depend on accurate information.
In terms of attack classification, this vulnerability maps to MITRE ATT&CK techniques involving unauthorized access and potential data exfiltration or modification. Specifically, it relates to Initial Access vectors where attackers exploit application layer vulnerabilities to gain entry into the system without prior authentication. The high complexity requirement suggests that automated scanning tools may not easily detect this flaw, requiring manual exploitation attempts with carefully crafted payloads. However, once exploited, the attacker gains a foothold that allows for further lateral movement or data manipulation within the context of the Primavera Unifier application. This underscores the importance of defense-in-depth strategies, as even difficult-to-exploit vulnerabilities can be leveraged by determined adversaries targeting high-value assets like construction and engineering project data.
Mitigation efforts must prioritize immediate patching to address this security deficiency. Oracle has released updates for versions 21.12.0 through 21.12.17, and organizations running these affected versions should apply the latest available patches as soon as possible. Until patches are applied, administrators can implement compensating controls such as restricting HTTP access to the application via firewall rules or web application firewalls that inspect incoming requests for suspicious patterns indicative of exploitation attempts. Additionally, enabling comprehensive logging and monitoring on the Core component can help detect anomalous activity associated with unauthenticated access attempts. Regular security assessments and penetration testing should be conducted to identify similar weaknesses in other components of the Oracle Construction and Engineering suite. Maintaining strict version control and ensuring timely updates are critical practices for preserving the integrity and confidentiality of enterprise project management systems against evolving cyber threats.