Live › vulnerability › CVE-2026-101736
Go to dashboardOracle Primavera Unifier Core component versions 21.12.0 through 21.12.17 contain a flaw that an unauthenticated attacker can reach over HTTP, with high difficulty to exploit. Successful exploitation can allow unauthorized reading, creation, modification or deletion of critical data held in Unifier.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running Oracle Primavera Unifier 21.12.0 through 21.12.17 with the Core component reachable over HTTP from a network. The sources do not say which deployment modes or configurations are exposed, so whether a given instance is reachable is unknown.
No product ranges from the sources yet.
21.12.0 to 21.12.1721.12.17 as listed in Oracle's Critical Patch UpdateEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core). Supported versions that are affected are 21.12.0-21.12.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101736")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.