CVE-2026-101521

CriticalCVSS 9.8

Published: 20/10/2026(UTC)Translated: 21/10/2026(UTC)NVD NIST

Summary

Vulnerability in Oracle APEX (component: General) affecting versions 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. An unauthenticated attacker with HTTPS network access can easily exploit it to take over Oracle APEX. CVSS 3.1 Base Score is 9.8.

Risk Assessment

Very high risk — an unauthenticated network attacker can take over the APEX platform, impacting confidentiality, integrity and availability of applications.

Recommendation

Update Oracle APEX to a patched version as soon as possible and restrict HTTPS access to trusted networks.

Other vulnerabilities in Oracle APEX

See all

Original NVD description (English source)

Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX. Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS