‹ Back to list

CVE-2026-91376

Status: ReceivedMedium (6.5)—
Severity6.5Medium · CVSS 3.1
Exploitation probability—next 30 days
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management.

Read full descriptionShow less

Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N).

CVSS

Base score
6.5
Version
3.1
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

Exploitation probability (EPSS)

FIRST hasn't scored this CVE yet (usual for very recent or rejected CVEs).

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

El vector UI:R exige interacción de un usuario, lo que prevalece sobre PR:L; el texto describe acceso no autorizado a datos críticos y modificación, inserción o borrado de datos de P6.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Restrict File and Directory PermissionsRemote Data StorageEncrypt Sensitive InformationApplication Isolation and SandboxingExploit ProtectionUpdate Software

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Oracle — Primavera P6 Enterprise Project Portfolio ManagementAI

References

Show 1 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-91376",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "secalert_us@oracle.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 1.3
      }
    ]
  },
  "affected": [
    {
      "source": "secalert_us@oracle.com",
      "affectedData": [
        {
          "vendor": "Oracle Corporation",
          "product": "Primavera P6 Enterprise Project Portfolio Management",
          "versions": [
            {
              "status": "affected",
              "version": "21.12.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "21.12.21.9"
            },
            {
              "status": "affected",
              "version": "22.12.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "22.12.21.4"
            },
            {
              "status": "affected",
              "version": "23.12.0",
              "versionType": "custom",
              "lessThanOrEqual": "23.12.20"
            },
            {
              "status": "affected",
              "version": "24.12.0",
              "versionType": "custom",
              "lessThanOrEqual": "24.12.16"
            },
            {
              "status": "affected",
              "version": "25.12.0",
              "versionType": "custom",
              "lessThanOrEqual": "25.12.8"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-20T22:20:40.650",
  "references": [
    {
      "url": "https://www.oracle.com/security-alerts/cpuoct2026.html",
      "source": "secalert_us@oracle.com"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access).  Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data as well as  unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N)."
    }
  ],
  "lastModified": "2026-10-20T22:20:40.650",
  "sourceIdentifier": "secalert_us@oracle.com"
}