← Back to search

CVE-2026-101521

9.8 CRITICAL

Published 2026-10-20 · Updated 2026-10-22

AI risk analysis

Summary
Oracle APEX is vulnerable to an unauthenticated remote code execution flaw that allows attackers to fully compromise the application without needing any credentials or prior access. This critical vulnerability affects multiple versions of Oracle's web application development platform.
Exploitability
The vulnerability is easily exploitable with no prerequisites, requiring only network access via HTTPS to achieve full system compromise.
Blast radius
Successful exploitation could lead to complete takeover of Oracle APEX applications, potentially affecting all web applications built on the platform and exposing sensitive business data.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade to Oracle APEX 24.1.22, 24.2.21, or 26.1.5 to remediate this vulnerability.
webrceoracleapex

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX. Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-287, CWE-306

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.