CVE-2026-101521 PUBLISHED

Assigner: oracle
Reserved: 28.09.2026 Published: 20.10.2026 Updated: 21.10.2026

Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX. Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor Oracle Corporation
Product Oracle APEX
Versions
  • affected from 24.1.0 to 24.1.21 (incl.)
  • affected from 24.2.0 to 24.2.20 (incl.)
  • affected from 26.1.0 to 26.1.4 (incl.)

References

Problem Types