Oracle Apex
Monthly
Unauthorized data read in Oracle APEX 24.1, 24.2, and 26.1 is achievable by unauthenticated remote attackers via HTTP, exploiting an authentication bypass in the General component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network reachability with no authentication required, allowing exposure of a subset of APEX-accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and zero-auth requirements make this a credible opportunistic threat against internet-facing APEX deployments.
Unauthorized data read in Oracle APEX 24.1, 24.2, and 26.1 is achievable by unauthenticated remote attackers via HTTP, exploiting an authentication bypass in the General component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network reachability with no authentication required, allowing exposure of a subset of APEX-accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and zero-auth requirements make this a credible opportunistic threat against internet-facing APEX deployments.