---
id: "CVE-2026-101521"
kind: "vulnerability"
aliases: ["CVE-2026-101521"]
title: "Oracle APEX: unauthenticated network flaw lets attackers take over the app"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Oracle APEX", "fixed": ["24.1.22", "24.2.21", "26.1.5"], "affected": "24.1.0-24.1.21, 24.2.0-24.2.20, 26.1.0-26.1.4", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-apex", "oracle-database", "package", "self-hosted"]
not_affected_if: ["default-config", "managed-hosting"]
published_at: "2026-10-20T22:18:01+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-23T23:09:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101521", "first_seen_at": "2026-10-23T21:57:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:09:11+00:00"}]
---

# Oracle APEX: unauthenticated network flaw lets attackers take over the app

Oracle APEX versions 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4 contain a flaw that an unauthenticated attacker can reach over HTTPS. Successful exploitation gives the attacker full takeover of the APEX instance, scored CVSS 9.8.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle APEX affected 24.1.0-24.1.21, 24.2.0-24.2.20, 26.1.0-26.1.4 fixed 24.1.22, 24.2.21, 26.1.5

## How to check

In the database as a DBA, run: SELECT version_no FROM apex_release; (or SELECT VERSION FROM dba_registry WHERE comp_id='APEX';). Affected if it is 24.1.0-24.1.21, 24.2.0-24.2.20 or 26.1.0-26.1.4. APEX in Oracle Autonomous/managed services is patched by Oracle.

## Fix

Apply the Oracle October 2026 CPU APEX patch. Expected first fixed builds, inferred and not stated by Oracle: 24.1.22, 24.2.21, 26.1.5. Check the patch readme on My Oracle Support to confirm.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101521
- 2026-10-23T23:09:11+00:00 analyst — Oracle CPU Oct 2026 (20 Oct) lists CVE-2026-101521 for APEX 24.1.0-24.1.21, 24.2.0-24.2.20, 26.1.0-26.1.4; CVSS 9.8, no exploitation reported (not in KEV). Oracle does not name fixed builds in the pages I read; the fixed versions are inferred (first build outside each range, per Armis). No community posts searched. The patch download/readme was not read.

## Documents

- [advisory] Text Form of Oracle CPU October 2026 Risk Matrices https://www.oracle.com/security-alerts/cpuoct2026verbose.html
- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [mentions] Armis CVE-2026-101521 (inferred fixed versions) https://cve.armis.com/CVE-2026-101521

## From the sources

Vulnerability in Oracle APEX (component: General).  Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and  26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX.  Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_