What is the CVSS score of CVE-2026-60156?

CVE-2026-60156 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle APEX CVE-2026-60156

EUVD-2026-46562 MEDIUM

Information Exposure (CWE-200)

2026-07-21 oracle

GHSA-jq9m-m554-67qg

Information Disclosure Oracle Oracle Apex Oracle Corporation

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network HTTP access with no auth or user interaction required; impact limited to partial read of APEX data with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:27 vuln.today

DescriptionCVE.org

Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1, 24.2 and 26.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle APEX. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle APEX accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized data read in Oracle APEX 24.1, 24.2, and 26.1 is achievable by unauthenticated remote attackers via HTTP, exploiting an authentication bypass in the General component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network reachability with no authentication required, allowing exposure of a subset of APEX-accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and zero-auth requirements make this a credible opportunistic threat against internet-facing APEX deployments.

Technical ContextAI

Oracle APEX (Application Express) is a low-code, browser-based application development platform tightly integrated with the Oracle Database, typically deployed over HTTP/HTTPS and accessed through Oracle REST Data Services (ORDS) or the Oracle HTTP Server. The affected component is described broadly as 'General,' suggesting the bypass may reside in a foundational request-handling or session-validation layer rather than a specific application module. The CPE string (cpe:2.3:a:oracle_corporation:oracle_apex:*:*:*:*:*:*:*:*) confirms all editions are potentially in scope for versions 24.1, 24.2, and 26.1. The tag 'Authentication Bypass' aligns with a CWE-288 or CWE-306 class flaw - missing or improperly enforced authentication for a critical function - though Oracle has not disclosed a specific CWE identifier, leaving the precise root cause unconfirmed.

RemediationAI

Apply Oracle's July 2026 Critical Patch Update (CPU), available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses CVE-2026-60156 for affected APEX versions 24.1, 24.2, and 26.1. The exact patched APEX release version is not independently confirmed from available advisory data - consult Oracle's CPU documentation to identify the specific upgrade target. As a compensating control pending patching, restrict network access to Oracle APEX endpoints at the perimeter firewall or load balancer level, limiting exposure to trusted IP ranges and eliminating unauthenticated internet access to APEX HTTP endpoints; this directly counters the AV:N/PR:N attack vector while introducing access restrictions for legitimate remote users. Additionally, review APEX application-level access controls and data visibility settings to minimize what a bypass-enabled unauthenticated request could read.