{"id":"CVE-2026-101521","kind":"vulnerability","aliases":["CVE-2026-101521"],"related":[],"title":"Oracle APEX: unauthenticated network flaw lets attackers take over the app","description":"Vulnerability in Oracle APEX (component: General).  Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and  26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX.  Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle APEX versions 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4 contain a flaw that an unauthenticated attacker can reach over HTTPS. Successful exploitation gives the attacker full takeover of the APEX instance, scored CVSS 9.8.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle APEX","fixed":["24.1.22","24.2.21","26.1.5"],"affected":"24.1.0-24.1.21, 24.2.0-24.2.20, 26.1.0-26.1.4","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-apex","oracle-database","package","self-hosted"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"In the database as a DBA, run: SELECT version_no FROM apex_release; (or SELECT VERSION FROM dba_registry WHERE comp_id='APEX';). Affected if it is 24.1.0-24.1.21, 24.2.0-24.2.20 or 26.1.0-26.1.4. APEX in Oracle Autonomous/managed services is patched by Oracle.","fix":"Apply the Oracle October 2026 CPU APEX patch. Expected first fixed builds, inferred and not stated by Oracle: 24.1.22, 24.2.21, 26.1.5. Check the patch readme on My Oracle Support to confirm.","status":"open","published_at":"2026-10-20T22:18:01+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-23T22:38:54+00:00","updated_at":"2026-10-23T23:09:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:38:54Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Oracle APEX to a release newer than the affected ranges listed in the advisory (24.1.21, 24.2.20 or 26.1.4 are the last affected builds; the fixed build is unknown from these sources).","reach":"internet","title":"Oracle APEX: unauthenticated network flaw lets attackers take over the app","impact":"high","summary":"Oracle APEX versions 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4 contain a flaw that an unauthenticated attacker can reach over HTTPS. Successful exploitation gives the attacker full takeover of the APEX instance, scored CVSS 9.8.","category":"package","who_cares":["oracle-apex","oracle-database","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"attacker takes over the APEX instance and reads or changes its data","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-101521 and the first fixed APEX build per branch; confirm how to check the installed APEX version in the database.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000535,"input_tokens":3048,"output_tokens":460,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-101521 and the first fixed APEX build per branch; confirm how to check the installed APEX version in the database.","search":"'-101521':14A,17A '-2026':13A,16A '/av':125C '24.1.0':33B,77C '24.1.21':34B,78C '24.2.0':35B,79C '24.2.20':36B,80C '26.1.0':38B,82C '26.1.4':39B,83C '3.1':112C,124C '9.8':64B,115C 'access':92C 'affect':75C 'allow':87C 'apex':2A,19A,22B,31B,60B,68C,98C,110C 'app':11A 'attack':7A,46B,55B,89C,100C 'avail':119C 'base':113C 'compon':69C 'compromis':96C 'confidenti':116C 'contain':40B 'cve':12A,15A 'cvss':63B,111C,121C,123C 'databas':25B 'easili':84C 'exploit':52B,85C 'flaw':5A,42B 'full':56B 'general':70C 'give':53B 'h':133C 'h/a':132C 'h/i':131C 'host':29B 'https':50B,94C 'impact':120C 'instanc':61B 'integr':117C 'l/pr':127C 'let':6A 'n/ac':126C 'n/s':129C 'n/ui':128C 'network':4A,91C 'oracl':1A,21B,24B,30B,67C,97C,109C 'oracle':18A 'oracle-apex':20B 'oracle-databas':23B 'packag':26B 'reach':48B 'result':105C 'score':62B,114C 'self':28B 'self-host':27B 'success':51B,99C 'support':71C 'take':8A 'takeov':57B,107C 'u/c':130C 'unauthent':3A,45B,88C 'vector':122C 'version':32B,72C 'via':93C 'vulner':65C,86C,103C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101521","severity":null,"published_at":"2026-10-20T22:18:01+00:00","modified_at":"2026-10-22T23:17:58+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101521:377","url":null,"severity":null,"published_at":"2026-10-23T23:09:11+00:00","modified_at":"2026-10-23T23:09:11+00:00","first_seen_at":"2026-10-23T23:09:11+00:00","fetched_at":"2026-10-23T23:09:11+00:00","note":"Oracle CPU Oct 2026 (20 Oct) lists CVE-2026-101521 for APEX 24.1.0-24.1.21, 24.2.0-24.2.20, 26.1.0-26.1.4; CVSS 9.8, no exploitation reported (not in KEV). Oracle does not name fixed builds in the pages I read; the fixed versions are inferred (first build outside each range, per Armis). No community posts searched. The patch download/readme was not read."}],"documents":[{"id":1639,"url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","title":"Text Form of Oracle CPU October 2026 Risk Matrices","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1815,"url":"https://cve.armis.com/CVE-2026-101521","title":"Armis CVE-2026-101521 (inferred fixed versions)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}