Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-101521

Missing authentication allows unauthenticated takeover of Oracle APEX

CVSS 3.1
9.8 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-101521 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Oracle APEX (General) has an easily exploitable authentication flaw (CWE-287/CWE-306). An unauthenticated attacker with network access over HTTPS can compromise the product and take it over, affecting confidentiality, integrity, and availability. Supported affected releases are 24.1.0–24.1.21, 24.2.0–24.2.20, and 26.1.0–26.1.4.

What to do: Apply Oracle's security update that addresses CVE-2026-101521 for the affected APEX releases. No workaround is stated.

ProductAffected
Oracle APEX24.1.0-24.1.21, 24.2.0-24.2.20, 26.1.0-26.1.4
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX. Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Weakness
CWE-287, CWE-306
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories