PT-2026-3681 · Oracle · Oracle Apex Sample Applications+1

Kanika Jalal + 1 · Published 2026-01-20 · Updated 2026-01-21 · CVE-2026-21931

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Oracle APEX Sample Applications versions 23.2.0 through 23.2.1 Oracle APEX Sample Applications versions 24.1.0 through 24.2.1

Description A flaw exists within the Oracle APEX Sample Applications product, specifically the Brookstrut Sample App component. This issue allows a low-privileged attacker with network access via HTTP to compromise the application. Exploitation requires interaction from a user other than the attacker. While the issue is present in Oracle APEX Sample Applications, attacks may impact other products. Successful exploitation can lead to unauthorized data modification, insertion, deletion, and read access.

Recommendations Update Oracle APEX Sample Applications to a version later than 24.2.1. Update Oracle APEX Sample Applications to a version later than 23.2.1. Update Oracle APEX Sample Applications to a version later than 24.1.0. Update Oracle APEX Sample Applications to a version later than 23.2.0.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2026-01006

CVE-2026-21931

Affected Products

Brookstrut Sample App

Oracle Apex Sample Applications

References · 6

• https://oracle.com/security-alerts/cpujan2026.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21931 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21931 · Security Note
• https://bdu.fstec.ru/vul/2026-01006 · Security Note
• https://twitter.com/CVEnew/status/2013783026027896904 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2026012077 · Note