CVE-2021-2351: Oracle Advanced Networking Option

High severity, CVSS 8.3. EPSS: 2.4% chance of exploitation in the next 30 days.

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

Affected products

Oracle Advanced Networking Option: version 12.1.0.2 only; version 12.2.0.1 only; version 19c only
Oracle Agile Engineering Data Management: version 6.2.1.0 only
Oracle Agile Product Lifecycle Management: version 9.3.6 only
Oracle Agile Product Lifecycle Management For Process: version 6.2.2.0 only; version 6.2.3.0 only
Oracle Airlines Data Model: version 12.1.1.0.0 only; version 12.2.0.1.0 only
Oracle Application Performance Management: version 13.4.1.0 only; version 13.5.1.0 only
Oracle Application Testing Suite: version 13.3.0.1 only
Oracle Argus Analytics: version 8.2.1 only; version 8.2.2 only; version 8.2.3 only
Oracle Argus Insight: version 8.2.1 only; version 8.2.2 only; version 8.2.3 only
Oracle Argus Mart: version 8.2.1 only; version 8.2.2 only; version 8.2.3 only
Oracle Argus Safety: version 8.2.1 only; version 8.2.2 only; version 8.2.3 only
Oracle Banking Apis: from 18.1, up to and including 18.3; version 19.1 only; version 19.2 only; version 20.1 only; version 21.1 only
Oracle Banking Digital Experience: from 18.1, up to and including 18.3; version 17.2 only; version 19.1 only; version 19.2 only; version 20.1 only; version 21.1 only
Oracle Banking Enterprise Default Management: version 2.10.0 only; version 2.12.0 only
Oracle Banking Platform: version 2.6.2 only; version 2.7.1 only; version 2.12.0 only
Oracle Big Data Spatial And Graph: before 23.1 (fixed in 23.1)
Oracle Blockchain Platform: version 21.1.2 only
Oracle Clinical: version 5.2.1 only; version 5.2.2 only
Oracle Commerce Platform: version 11.3.0 only; version 11.3.1 only; version 11.3.2 only
Oracle Communications Application Session Controller: version 3.9.0 only
Oracle Communications Billing And Revenue Management: version 12.0.0.4 only; version 12.0.0.5 only
Oracle Communications Calendar Server: version 8.0.0.5.0 only
Oracle Communications Contacts Server: version 8.0.0.3.0 only
Oracle Communications Convergent Charging Controller: from 12.0.1.0.0, up to and including 12.0.4.0.0; version 6.0.1.0.0 only
Oracle Communications Data Model: version 11.3.2.1.0 only; version 11.3.2.2.0 only; version 11.3.2.3.0 only; version 12.1.0.1.0 only; version 12.1.2.0.0 only
and 86 more

Published 2021-07-21. Last modified 2026-08-25.