EUVD-2026-46988
GHSA-cpgq-2w42-46r2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack requiring low-privilege OS account aligns with AV:L/PR:L; installation artifact misconfiguration means no complexity (AC:L); only confidentiality is impacted (C:H/I:N/A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in Oracle APEX (component: Installation). Supported versions that are affected are 24.1, 24.2 and 26.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle APEX executes to compromise Oracle APEX. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle APEX accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Local privilege escalation of data access in Oracle APEX's Installation component allows a low-privileged OS user to read all data accessible to the APEX platform. Affected versions are 24.1, 24.2, and 26.1. Despite the 'Authentication Bypass' tag suggesting a control-plane weakness during or after installation, exploitation is constrained to attackers with an existing local logon to the host infrastructure - no public exploit identified at time of analysis and no CISA KEV listing.
Technical ContextAI
Oracle APEX (Application Express) is a low-code web application development platform that runs inside the Oracle Database engine and is accessed via Oracle REST Data Services (ORDS) or the embedded PL/SQL gateway. The affected component is 'Installation', which encompasses setup scripts, configuration files, default schema objects, and credential artifacts written to the filesystem or database during initial deployment or upgrade. The CWE is not specified by the vendor, but the 'Authentication Bypass' tag suggests the root cause class is likely CWE-284 (Improper Access Control) or CWE-522 (Insufficiently Protected Credentials) - installation artifacts may be left with world-readable OS permissions or overly permissive database grants that allow any authenticated OS/DB user to read sensitive APEX metadata or credentials. The CVSS local attack vector (AV:L) confirms exploitation requires physical or logical access to the host, not network reachability.
RemediationAI
Apply the Oracle Critical Patch Update (CPU) for July 2026, referenced at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle CPUs are cumulative, so applying the July 2026 patch set for the affected APEX release stream (24.1, 24.2, or 26.1) should address this vulnerability; however, no specific patched version number was disclosed in the available data - consult the Oracle support portal (My Oracle Support) for the exact patch bundle ID for your version. As a compensating control prior to patching, administrators should audit OS filesystem permissions on APEX installation directories to ensure configuration files and credential artifacts are not world-readable; restrict access to the APEX schema objects in the Oracle Database to only the APEX engine user; and apply the principle of least privilege to OS accounts that have logon access to the APEX host. Note that restricting OS logon access reduces attack surface but may impact legitimate DBA and monitoring workflows. No workaround eliminating the vulnerability without patching has been identified from available data.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed
NVIDIA Apex for all platforms contains a vulnerability in a Python component where an attacker could cause a code inject
Apex versions up to 23.2.0 contains a vulnerability that allows attackers to unauthorized update, insert or delete acces
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today