CVE-2026-91376 in Primavera P6 Enterprise Project Portfolio Management
Summary
by MITRE • 10/21/2026
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Web Access component of Oracle Primavera P6 Enterprise Project Portfolio Management, a critical software suite used for managing complex construction and engineering projects. This flaw affects multiple supported versions spanning from 21.12 through 25.12, indicating a systemic issue in how the web interface handles specific user inputs or state transitions. The vulnerability is characterized by its difficulty to exploit, requiring high attack complexity which suggests that standard automated scanning tools may not easily detect it without specialized techniques. Furthermore, exploitation necessitates low-privileged network access via HTTP and crucially depends on human interaction from a victim other than the attacker. This social engineering aspect implies that an adversary must trick a legitimate user into performing an action, such as clicking a malicious link or interacting with a crafted web page, to trigger the exploit condition within the application context of the authenticated session.
From a technical perspective, this vulnerability aligns closely with CWE-79, which covers Cross-Site Scripting (XSS) vulnerabilities where untrusted data is not properly validated before being sent to a user's browser. The requirement for human interaction and network access via HTTP points toward an attack vector similar to ATT&CK technique T1059, specifically command or script interpretation through web-based mechanisms like JavaScript execution in the context of the vulnerable application. Although the base CVSS score is rated at 6.5 due to high complexity and required privileges, the scope change indicator reveals that successful exploitation can impact additional products beyond just Primavera P6. This suggests a potential chain reaction where compromising the session or data integrity in one module allows lateral movement or unauthorized access to integrated systems within the broader Oracle Construction and Engineering ecosystem, thereby escalating the risk from an isolated application flaw to a multi-system compromise scenario.
The operational impact of this vulnerability is significant despite its exploitation difficulty. Successful attacks can lead to unauthorized access to critical project data, including sensitive financial records, resource allocations, and schedule details that are central to enterprise operations. Beyond confidentiality breaches, the integrity of the system is compromised as attackers gain the ability to update, insert, or delete accessible data within Primavera P6. This capability allows for malicious manipulation of project timelines, budgets, or assignments, which can cause substantial financial loss, operational delays, and reputational damage to organizations relying on accurate portfolio management. The combination of unauthorized access and modification capabilities means that an attacker could alter critical business logic embedded in the project plans, leading to cascading failures across dependent departments such as finance, procurement, and engineering teams who rely on this data for decision-making.
Mitigation strategies must address both the technical configuration and user awareness aspects of this threat vector. Organizations should immediately apply the latest security patches provided by Oracle for all affected versions listed in the advisory, ensuring that the Web Access component is updated to a version where the input validation flaws are resolved. Since exploitation requires human interaction, implementing strict Content Security Policy headers can help mitigate potential script injection attempts even if other defenses fail. Additionally, enforcing HTTPS instead of HTTP eliminates the risk associated with unencrypted transmission and may prevent certain types of man-in-the-middle attacks that facilitate this specific exploit path. User training programs should be reinforced to educate employees on recognizing suspicious links or requests originating from external sources, as social engineering remains a primary prerequisite for successful exploitation in this scenario. Regular audits of web application firewalls can also help detect anomalous patterns indicative of attempted XSS or session hijacking activities targeting the Primavera P6 interface.