CVE-2026-91399 in Primavera P6 Enterprise Project Portfolio Management
Summary
by MITRE • 10/21/2026
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The identified vulnerability resides within the Web Access component of Oracle Primavera P6 Enterprise Project Portfolio Management, a widely used software suite for managing complex construction and engineering projects. This security flaw affects multiple supported versions spanning from 21.12 through to the latest releases up to version 25.12.8, indicating a systemic issue in how the web interface handles specific input parameters or state transitions. The vulnerability is classified as easily exploitable by an attacker with low privileges who possesses network access via HTTP. This classification suggests that no user interaction such as clicking a malicious link is required for exploitation, and the attack vector does not necessitate high-level administrative rights on the target system prior to execution.
From a technical perspective, this vulnerability represents a failure in proper authorization checks or input validation within the web application layer. The core flaw allows an authenticated but low-privileged user to manipulate data that they should not have access to modify. Specifically, the attacker can perform unauthorized update, insert, or delete operations on accessible data within the Primavera P6 database. This type of defect is commonly associated with Broken Access Control vulnerabilities where the application fails to enforce policy restrictions effectively when processing requests from users with limited permissions. The ability to alter, add, or remove records directly impacts the integrity of project schedules, resource allocations, and cost tracking mechanisms that are critical for enterprise operations.
The operational impact of this vulnerability is significant due to its effect on data integrity rather than confidentiality or availability. While an attacker cannot necessarily read sensitive information they do not already have access to, nor can they disrupt service availability through denial-of-service techniques in the context described, the ability to silently corrupt project data poses a severe risk. Unauthorized modifications could lead to inaccurate financial reporting, misallocated resources, missed deadlines, and compromised audit trails. In an enterprise environment where Primavera P6 is central to decision-making processes, such integrity violations can result in substantial financial loss and reputational damage. The CVSS 3.1 base score of 4.3 reflects this medium-level risk profile, emphasizing the importance of data consistency over other security metrics for this specific flaw.
In terms of industry standard mappings, this vulnerability aligns with CWE-862 Missing Authorization, which describes a situation where an application does not properly verify that a user has permission to perform a requested action. It also relates closely to CWE-918 Server-Side Request Forgery if the underlying mechanism involves manipulating server-side processes through crafted inputs, though the primary classification remains focused on access control failures. From an offensive security perspective, this aligns with MITRE ATT&CK technique T1078 Valid Accounts, as it requires valid credentials to exploit, and potentially T1564 Hidden Files and Directories if the attacker attempts to obscure their modifications within legitimate project data structures for persistence or evasion purposes.
Mitigation strategies should prioritize immediate patching of all affected versions listed in the advisory. Organizations must ensure that Oracle Security Alerts are monitored closely and applied promptly via official support channels. In addition to software updates, implementing strict network segmentation can limit exposure by restricting HTTP access to the Primavera P6 Web Access component only from trusted internal networks or through a secure web application firewall with robust rule sets designed to detect anomalous data manipulation patterns. Enforcing multi-factor authentication for all user accounts adds an additional layer of defense against credential theft which could facilitate this low-privilege exploitation. Regular audits of user permissions and role-based access controls within the Primavera P6 administration console are also recommended to ensure that users operate strictly within their designated boundaries, minimizing the potential impact if a similar vulnerability were discovered in other components.