{"id":"CVE-2026-101521","published":"2026-10-20T22:18:01.470","lastModified":"2026-10-22T23:17:58.930","description":"Vulnerability in Oracle APEX (component: General).  Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and  26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX.  Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287","CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Oracle APEX is vulnerable to an unauthenticated remote code execution flaw that allows attackers to fully compromise the application without needing any credentials or prior access. This critical vulnerability affects multiple versions of Oracle's web application development platform.","exploitability":"The vulnerability is easily exploitable with no prerequisites, requiring only network access via HTTPS to achieve full system compromise.","blast_radius":"Successful exploitation could lead to complete takeover of Oracle APEX applications, potentially affecting all web applications built on the platform and exposing sensitive business data.","remediation":"Upgrade to Oracle APEX 24.1.22, 24.2.21, or 26.1.5 to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","rce","oracle","apex"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:23:54.882Z"}}