by Kastro
Paper/Archive/CVE-2026-101521

CVE-2026-101521

Oracle Corporation Oracle APEX — Vulnerability in Oracle APEX (component: General).

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 47.4.474 × 209.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX. Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected

ProductAffectedFixed inSource
Oracle APEX24.1.0 – 24.1.21–CNA
Oracle APEX24.2.0 – 24.2.20–CNA
Oracle APEX26.1.0 – 26.1.4–CNA

Scores by source

oracle (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryoracle.com/security-alerts/cpuoct2026.html