CVE-2021-2351

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-07-21 · updated 2026-08-25
Weakness: CWE-327

Description

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

Affected products

Oracle Corporation Advanced Networking Option: 12.1.0.2, 12.2.0.1, 19c
Oracle Corporation Oracle Agile Engineering Data Management: 6.2.1.0
Oracle Corporation Oracle Agile PLM: 9.3.6
Oracle Corporation Oracle Agile Product Lifecycle Management for Process: 6.2.2.0, 6.2.3.0
Oracle Airlines Data Model: 12.1.1.0.0, 12.2.0.1.0
Oracle Corporation APM - Application Performance Management: 13.4.1.0, 13.5.1.0
Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
Oracle Argus Analytics: 8.2.1, 8.2.2, 8.2.3
Oracle Argus Insight: 8.2.1, 8.2.2, 8.2.3
Oracle Argus Mart: 8.2.1, 8.2.2, 8.2.3
Oracle Corporation Argus Safety: 8.2.1, 8.2.2, 8.2.3
Oracle Banking Apis: from 18.1 through 18.3; 19.1, 19.2, 20.1, 21.1
Oracle Corporation Banking Digital Experience: from 18.1 through 18.3; 17.2, 19.1, 19.2, 20.1, 21.1
Oracle Banking Enterprise Default Management: 2.10.0, 2.12.0
Oracle Banking Platform: 2.6.2, 2.7.1, 2.12.0
Oracle Big Data Spatial And Graph: before 23.1 — fixed in 23.1
Oracle Blockchain Platform: 21.1.2
Oracle Clinical: 5.2.1, 5.2.2
Oracle Corporation Oracle Commerce Platform: 11.3.0, 11.3.1, 11.3.2
Oracle Communications Application Session Controller: 3.9.0
Oracle Corporation Communications Billing and Revenue Management: 12.0.0.4, 12.0.0.5
Oracle Communications Calendar Server: 8.0.0.5.0
Oracle Communications Contacts Server: 8.0.0.3.0
Oracle Corporation Oracle Communications Convergent Charging Controller: from 12.0.1.0.0 through 12.0.4.0.0; 6.0.1.0.0
Oracle Communications Data Model: 11.3.2.1.0, 11.3.2.2.0, 11.3.2.3.0, 12.1.0.1.0, 12.1.2.0.0
Oracle Communications Design Studio: 7.3.5, 7.4.0, 7.4.1, 7.4.2
Oracle Communications Diameter Intelligence Hub: from 8.0.0 through 8.2.3
Oracle Communications Ip Service Activator: 7.4.0
Oracle Communications Metasolv Solution: 6.3.1
Oracle Communications Network Charging And Control: from 12.0.1.0 through 12.0.4.0.0; 6.0.1.0.0

How to fix

Upgrade to a fixed version: Oracle Big Data Spatial And Graph 23.1; Oracle Corporation Oracle GoldenGate 12.3.0.1.0, 21.5.0.0.220118; Oracle Goldengate Application Adapters 23.1; Oracle Graph Server And Client 21.4.0; Oracle Corporation Hospitality Inventory Management 9.1.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-2351 or the next vulnerability affects your stack