CVE-2018-2960: Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction...

Security readout for executives and security teams

CVE-2018-2960 affects Oracle Primavera P6 Enterprise Project Portfolio Management Web Access. An unauthenticated attacker on the network can trigger the issue over HTTP if a user interacts with malicious content. Successful exploitation can read some project data and modify some accessible data, creating confidentiality and integrity risk for project portfolio operations. Exposure is most likely where Primavera P6 EPPM Web Access is reachable over HTTP by users or external networks. The bundle does not identify affected configurations beyond listed versions, so validate product version, Web Access deployment, and network reachability before prioritizing remediation. Prioritize remediation for internet-facing or broadly reachable Primavera environments, especially where project data integrity matters. Internal-only systems still deserve scheduled patching because exploitation needs no attacker authentication and only requires user interaction. Mitigation focus: Review Oracle July 2018 Critical Patch Update guidance for Primavera P6 EPPM.; Apply the relevant Oracle-supported patch or upgrade path for affected versions.; Restrict Web Access exposure to trusted networks where operationally possible..

Prepared

Jun 7, 2026, 13:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.