CRITICAL

CVE-2026-101521

Oracle Corporation — Oracle APEX

Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX. Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS9.8

EPSS0.6%

Exploit StatusNot Assessed

PublishedOct 20, 2026

Last ModifiedOct 22, 2026

VendorOracle Corporation

ProductOracle APEX

Weakness (CWE)CWE-287, CWE-306

View on NVD

Vulnerability Timeline

PublishedOct 20, 2026

Last ModifiedOct 22, 2026

Seraph Context

Technology Watch Match

Available for technologies you monitor inside Seraph CTI.

Relevant Threat Actors

Surfaced automatically when a documented actor is linked to this CVE.

Sector Context

Shown when this vendor/product is relevant to your industry.

Exploitation Context

Campaign and indicator context, where Seraph analysts have published it.

References

https://www.oracle.com/security-alerts/cpuoct2026.html

More from Oracle Corporation in the catalogue.

CVE-2026-114820Oracle Java SEPublished Oct 24, 2026 CVE-2026-91403Oracle Java SEPublished Oct 21, 2026 CVE-2026-91668Oracle Data IntegratorPublished Oct 20, 2026

Does this affect technology you run?

Declare your technology stack inside Seraph CTI and get notified the moment a vulnerability matches it.

Explore Seraph CTI Back to Vulnerability Catalogue