EUVD-2026-105934
GHSA-rhq8-7qph-vw39
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach APEX endpoint over HTTPS
-
DeliverySend crafted unauthenticated request
-
ExploitExploit flaw in General component
-
ExecutionGain full APEX takeover
-
ImpactExfiltrate and tamper with application data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTPS against network-reachable Oracle APEX instances (General component), per AV:N/AC:L/PR:N/UI:N. Limiting factors: the target APEX service must be network-accessible to the attacker (HTTPS), and the instance must run an affected version (24.1.0-24.1.21, 24.2.0-24.2.20, or 26.1.0-26.1.4); instances fully patched via the Oracle October 2026 CPU or isolated from untrusted networks are not exposed. The description names no feature toggle or non-default configuration prerequisite, implying default deployments are affected. |
| Impact | All available signals point to genuine high priority. The vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes remote, network-reachable exploitation over HTTPS with no authentication, no user interaction, and low complexity, resulting in full confidentiality, integrity, and availability loss - characterized by Oracle as 'easily exploitable' leading to 'takeover of Oracle APEX.' However, several corroborating signals are MISSING: no EPSS probability was provided, the CVE is not listed in CISA KEV, no public POC is referenced, and no SSVC decision data is supplied. Thus the 9.8 reflects theoretical worst-case impact rather than confirmed in-the-wild activity - this is a high-CVSS issue whose real-world exploitation likelihood cannot be quantified from the given data. CWE is listed as N/A, so the precise flaw class is unknown, and the sole reference is the Oracle October 2026 Critical Patch Update page with no technical write-up. Note also that the single technique tag 'Information Disclosure' understates the vendor's stated full-takeover (C:H/I:H/A:H) impact; treat the CIA vector, not the tag, as authoritative. Recommendation: prioritize patching via the Oracle CPU given the unauthenticated network-takeover profile, while recognizing exploitation-in-the-wild is unconfirmed. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker reaches an internet- or network-exposed Oracle APEX instance over HTTPS and sends a crafted request to the General component that requires no credentials, no user interaction, and only low attack complexity. Successful exploitation yields full compromise ('takeover') of the APEX environment, exposing and altering all hosted application data. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle APEX versions 24.1.0 through 24.1.21, 24.2.0 through 24.2.20, and 26.1.0 through 26.1.4 contain an easily exploitable flaw in the General component that unauthenticated remote attackers can reach over HTTPS to fully compromise the APEX instance, with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 9.8). The Oracle CPU October 2026 advisory is the vendor's reference for this issue, and no public exploit code or CISA KEV listing was identified in the available data at time of analysis. Network exposure is the primary gating factor: any internet-reachable or otherwise attacker-accessibly APEX deployment on an affected release should be treated as high priority for patching.
RemediationAI
Apply the Oracle October 2026 Critical Patch Update, which is the vendor-released fix referenced by this CVE (https://www.oracle.com/security-alerts/cpuoct2026.html); upgrade APEX to a release level above 24.1.21, 24.2.20, or 26.1.4 respectively, following Oracle's documented APEX patching procedure on the Oracle Database. No standalone workaround is documented in the supplied data, and because no feature toggle or non-default configuration prerequisite is described, there is no reliable configuration-based mitigation for an exposed instance. The effective compensating control is network-level: restrict HTTPS access to the APEX listener (via ORDS or the embedded PL/SQL gateway) to trusted networks through firewall rules, reverse-proxy allowlists, or VPN-only access, accepting that this breaks legitimate public-facing use of the application. Placing the instance behind a WAF can add detection value but is not a substitute for the patch given the 9.8 severity and unauthenticated attack path. Patch status: Vendor-released patch via the October 2026 CPU; no public exploit code was identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle APEX (Application Express) is Oracle's low-code web application development platform that runs inside the Oracle Database and is served to users over HTTPS via ORDS or the embedded PL/SQL gateway. This record concerns the 'General' component, indicating the defect lies in the core APEX runtime rather than a specific packaged application or plug-in; the CWE classification was not supplied, so the precise root-cause class (for example improper access control or input handling leading to privilege escalation) cannot be confirmed from the available data. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity attack requiring no credentials or user interaction, with full loss of confidentiality, integrity, and availability but scope unchanged - consistent with an attacker gaining control of the APEX application layer rather than the underlying database server. Because the description names no feature toggle, non-default configuration, or authenticated precondition, default deployments within the affected version ranges should be considered exposed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor describes easy unauthenticated network exploitation over HTTPS with no user interaction yielding full takeover, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX. Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle APEX deployments on affected 24.1, 24.2, and 26.1 releases expose the organization to a critical remotely reachable compromise of the APEX instance, with potential high impact to confidentiality, integrity, and availability. Because no vendor-released patch was identified at time of analysis, leadership should treat any internet-reachable or attacker-accessible APEX service as a high-priority operational risk. No public exploit was identified at time of analysis, but the severity and exposure profile warrant urgent containment and remediation planning.
No vendor-released patch identified at time of analysis; restrict network access to affected Oracle APEX deployments, place behind VPN or allowlists, enable WAF protections and enhanced logging, monitor for anomalous activity, and apply Oracle CPU October 2026 guidance when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB