CVE-2026-101521

LOWCVSS 9.8 · CRITICAL

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX. Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://www.oracle.com/security-alerts/cpuoct2026.html

Weakness type (CWE)

CWE-287CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post

Next Wave@nxtwavetech15h
October Critical Patch Update: 2 new APEX fixes, both remotely exploitable without auth. CVE-2026-101521 is a 9.8. No login, no click. On 24.1, 24.2 or 26.1? Check your version: https://www.oracle.com/security-alerts/cpuoct2026.html Patch this week, not next quarter. #orclapex #oracle #security
0000020
33 followersView on X

Explore more

Back to dashboard