CVE-2026-21931

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21931", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2026-01-05T18:07:34.709Z", "datePublished": "2026-01-20T21:56:23.267Z", "dateUpdated": "2026-01-21T20:55:14.477Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-01-20T21:56:23.267Z"}, "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle APEX Sample Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle APEX Sample Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle APEX Sample Applications accessible data as well as unauthorized read access to a subset of Oracle APEX Sample Applications accessible data."}]}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle APEX Sample Applications", "versions": [{"version": "23.2.0", "status": "affected", "versionType": "semver"}, {"version": "23.2.1", "status": "affected", "versionType": "semver"}, {"version": "24.1.0", "status": "affected", "versionType": "semver"}, {"version": "24.2.0", "status": "affected", "versionType": "semver"}, {"version": "24.2.1", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:oracle:apex_sample_applications:23.2.0:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:apex_sample_applications:23.2.1:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:apex_sample_applications:24.1.0:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:apex_sample_applications:24.2.0:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:apex_sample_applications:24.2.1:*:*:*:*:*:*:*"}]}]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the Oracle APEX Sample Applications product of Oracle APEX (component: Brookstrut Sample App). Supported versions that are affected are 23.2.0, 23.2.1, 24.1.0, 24.2.0 and 24.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle APEX Sample Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle APEX Sample Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle APEX Sample Applications accessible data as well as unauthorized read access to a subset of Oracle APEX Sample Applications accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)."}], "references": [{"url": "https://www.oracle.com/security-alerts/cpujan2026.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-21T20:55:02.947680Z", "id": "CVE-2026-21931", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T20:55:14.477Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21931", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-21T20:55:02.947680Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T20:55:11.812Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle APEX Sample Applications", "versions": [{"status": "affected", "version": "23.2.0", "versionType": "semver"}, {"status": "affected", "version": "23.2.1", "versionType": "semver"}, {"status": "affected", "version": "24.1.0", "versionType": "semver"}, {"status": "affected", "version": "24.2.0", "versionType": "semver"}, {"status": "affected", "version": "24.2.1", "versionType": "semver"}]}], "references": [{"url": "https://www.oracle.com/security-alerts/cpujan2026.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the Oracle APEX Sample Applications product of Oracle APEX (component: Brookstrut Sample App). Supported versions that are affected are 23.2.0, 23.2.1, 24.1.0, 24.2.0 and 24.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle APEX Sample Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle APEX Sample Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle APEX Sample Applications accessible data as well as unauthorized read access to a subset of Oracle APEX Sample Applications accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle APEX Sample Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle APEX Sample Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle APEX Sample Applications accessible data as well as unauthorized read access to a subset of Oracle APEX Sample Applications accessible data."}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:apex_sample_applications:23.2.0:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:apex_sample_applications:23.2.1:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:apex_sample_applications:24.1.0:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:apex_sample_applications:24.2.0:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:apex_sample_applications:24.2.1:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}], "providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-01-20T21:56:23.267Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21931", "state": "PUBLISHED", "dateUpdated": "2026-01-21T20:55:14.477Z", "dateReserved": "2026-01-05T18:07:34.709Z", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "datePublished": "2026-01-20T21:56:23.267Z", "assignerShortName": "oracle"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Oracle APEX Sample Applications", "vendor": "Oracle Corporation", "versions": [{"status": "affected", "version": "23.2.0", "versionType": "semver"}, {"status": "affected", "version": "23.2.1", "versionType": "semver"}, {"status": "affected", "version": "24.1.0", "versionType": "semver"}, {"status": "affected", "version": "24.2.0", "versionType": "semver"}, {"status": "affected", "version": "24.2.1", "versionType": "semver"}]}], "source": "secalert_us@oracle.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:apex:23.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "FC8552BC-0210-47B5-A8F0-BDDE9D4246A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:apex:23.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "819C823C-EBA7-44E6-A628-DD464CC42766", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:apex:24.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "137641FC-136A-43F7-8C49-1322726486CC", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:apex:24.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "A7DC2D29-4FE4-4FFA-878C-7275993BC3C8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle APEX Sample Applications product of Oracle APEX (component: Brookstrut Sample App). Supported versions that are affected are 23.2.0, 23.2.1, 24.1.0, 24.2.0 and 24.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle APEX Sample Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle APEX Sample Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle APEX Sample Applications accessible data as well as unauthorized read access to a subset of Oracle APEX Sample Applications accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle APEX Sample Applications de Oracle APEX (componente: Brookstrut Sample App). Las versiones compatibles que est\u00e1n afectadas son 23.2.0, 23.2.1, 24.1.0, 24.2.0 y 24.2.1. La vulnerabilidad f\u00e1cilmente explotable permite a un atacante con pocos privilegios y acceso a la red v\u00eda HTTP comprometer Oracle APEX Sample Applications. Los ataques exitosos requieren interacci\u00f3n humana de una persona que no sea el atacante y, aunque la vulnerabilidad est\u00e1 en Oracle APEX Sample Applications, los ataques pueden impactar significativamente productos adicionales (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado de actualizaci\u00f3n, inserci\u00f3n o eliminaci\u00f3n a algunos de los datos accesibles de Oracle APEX Sample Applications, as\u00ed como acceso de lectura no autorizado a un subconjunto de los datos accesibles de Oracle APEX Sample Applications. Puntuaci\u00f3n Base CVSS 3.1 de 5.4 (impactos en la Confidencialidad y la Integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)."}], "id": "CVE-2026-21931", "lastModified": "2026-06-17T10:19:11.397", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "secalert_us@oracle.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21931", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-21T20:55:02.947680Z", "version": "2.0.3"}}]}, "published": "2026-01-20T22:15:55.667", "references": [{"source": "secalert_us@oracle.com", "tags": ["Vendor Advisory"], "url": "https://www.oracle.com/security-alerts/cpujan2026.html"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T04:37:45.655936+00:00", "value": {"mitigation_remediation": ["Install the latest Oracle APEX security patch or update that addresses the Brookstrut Sample App flaw.", "Block or restrict external HTTP traffic to the APEX Sample Application environment, limiting exposure to trusted sources only.", "Enforce strict access controls on the Sample Application, ensuring that low privileged users cannot execute update, insert or delete actions, and review permissions regularly.", "Disable or remove the Brookstrut Sample App if it is not required, reducing the attack surface.", "Monitor logs for suspicious activity involving unauthorized data access or modification and investigate anomalies."], "summary": {"action": "Assess Impact", "impact": "Unauthorized Data Manipulation and Read via HTTP"}, "threat_synthesis": {"affected_systems": "Oracle Corporation's Oracle APEX Sample Applications, specifically the Brookstrut Sample App, in versions 23.2.0, 23.2.1, 24.1.0, 24.2.0 and 24.2.1.", "description_and_impact": "The vulnerability in Oracle APEX Sample Applications' Brookstrut Sample App allows an attacker with low privileges and network access to HTTP to perform unauthorized update, insert, delete and read operations on accessible data. The flaw can be exploited only when an additional human actor interacts with the application, implying a social engineering component. Successful exploitation leads to confidentiality and integrity impacts to a subset of data.", "risk_and_exploitability": "CVSS 3.1 base score of 5.4 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not currently listed in the KEV catalog. The attack vector is likely HTTP network access, with low privileged user and human interaction from a non-attacker, indicating that social engineering or phishing may be needed. Because the flaw can change the integrity scope, unpatched systems could be exposed to unauthorized data modification if exploited, but the overall risk remains moderate."}}}}, "created": "2026-04-18T04:45:36.864374+00:00", "updated": "2026-04-18T04:45:36.864384+00:00", "vendors": []}