CVE-2026-60156
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Vulnerability in Oracle APEX (General). An unauthenticated attacker via HTTP can read a subset of data.
Risk Assessment
Risk of data leakage from APEX applications.
Recommendation
Update Oracle APEX to versions 24.1, 24.2, or 26.1 with the latest patches.
Other vulnerabilities in Oracle APEX
See all- CVE-2026-101521Critical
Vulnerability in Oracle APEX (component: General) affecting versions 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. An unauthenticated attacker with HTTPS network access can easily exploit it to take over Oracle APEX. CVSS 3.1 Base Score is 9.8.
- CVE-2026-60630Medium
A vulnerability in Oracle APEX allows a low-privileged attacker with local access to gain complete access to all APEX data.
Original NVD description (English source)
Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1, 24.2 and 26.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle APEX. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle APEX accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS