CVE-2026-101521 is a critical (CVSS 3.1 score of 9.8) vulnerability in the General component of Oracle APEX that lets an unauthenticated attacker with network access over HTTPS take over the application.
What Is It
Oracle published CVE-2026-101521 to the National Vulnerability Database (NVD) on October 20, 2026. Oracle's description calls it an "easily exploitable vulnerability" in the General component of Oracle APEX. An attacker with no credentials and network access over HTTPS can use it to compromise Oracle APEX, and a successful attack can take over the APEX instance.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Impact: High to confidentiality, integrity and availability
NVD lists the record as "Received," so NVD has not yet published its own analysis.
Why It Matters
This flaw combines several risk factors. It can be reached over the network, it needs no login or user action, and Oracle rates exploitation as low complexity. A successful attack gives the attacker control of the APEX instance and high impact on confidentiality, integrity and availability.
Exploitation status: No CISA Known Exploited Vulnerabilities (KEV) entry was supplied for this CVE. The source material does not confirm active exploitation. Still, internet-facing APEX deployments should be treated as high-priority given how easily the flaw can be exploited.
What's Vulnerable
Oracle lists these supported versions of Oracle APEX as affected:
- 24.1.0 through 24.1.21
- 24.2.0 through 24.2.20
- 26.1.0 through 26.1.4
The NVD record lists no CPE entries.
Patch Status
The only reference in the NVD record is Oracle's October 2026 Critical Patch Update advisory (cpuoct2026). The supplied records do not name fixed version numbers or any workarounds. Because there is no KEV entry, no CISA-mandated required action or due date applies at this time.
Administrators should:
- Review the Oracle advisory for remediation guidance.
- Check APEX deployments against the affected version ranges above.
- Apply Oracle's fixes as soon as possible, starting with instances reachable over HTTPS from untrusted networks.