Live › vulnerability › CVE-2026-91376
Go to dashboardOracle Primavera P6 Enterprise Project Portfolio Management has a flaw in its Web Access component that a low-privileged user can trigger over HTTP. A successful attack can read critical project data and change or delete some of it, and can affect other products.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running Primavera P6 Enterprise Project Portfolio Management in the listed version ranges with the Web Access component reachable by users over HTTP. Exploitation needs a low-privileged account and a second person to interact with the attack, so instances restricted to trusted users are at lower risk; hosted instances managed by Oracle are handled by the vendor.
No product ranges from the sources yet.
21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16, 25.12.0-25.12.8Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-91376")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.