{"id":"CVE-2021-2351","title":"Vulnerability in the Advanced Networking Option component of Oracle Database Server","summary":"Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network acc…","severity":"high","cvss":8.3,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":["CWE-327","CWE-384"],"vendor":"oracle","product":"advanced_networking_option","affected":["advanced_networking_option = 12.1.0.2","advanced_networking_option = 12.2.0.1","advanced_networking_option = 19c","agile_engineering_data_management = 6.2.1.0","agile_product_lifecycle_management = 9.3.6","agile_product_lifecycle_management_for_process = 6.2.2.0","agile_product_lifecycle_management_for_process = 6.2.3.0","airlines_data_model = 12.1.1.0.0","airlines_data_model = 12.2.0.1.0","application_performance_management = 13.4.1.0","application_performance_management = 13.5.1.0","application_testing_suite = 13.3.0.1","argus_analytics = 8.2.1","argus_analytics = 8.2.2","argus_analytics = 8.2.3","argus_insight = 8.2.1","argus_insight = 8.2.2","argus_insight = 8.2.3","argus_mart = 8.2.1","argus_mart = 8.2.2","argus_mart = 8.2.3","argus_safety = 8.2.1","argus_safety = 8.2.2","argus_safety = 8.2.3","banking_apis >= 18.1, <= 18.3","banking_apis = 19.1","banking_apis = 19.2","banking_apis = 20.1","banking_apis = 21.1","banking_digital_experience >= 18.1, <= 18.3","banking_digital_experience = 17.2","banking_digital_experience = 19.1","banking_digital_experience = 19.2","banking_digital_experience = 20.1","banking_digital_experience = 21.1","banking_enterprise_default_management = 2.10.0","banking_enterprise_default_management = 2.12.0","banking_platform = 2.6.2","banking_platform = 2.7.1","banking_platform = 2.12.0","big_data_spatial_and_graph < 23.1","blockchain_platform = 21.1.2","clinical = 5.2.1","clinical = 5.2.2","commerce_platform = 11.3.0","commerce_platform = 11.3.1","commerce_platform = 11.3.2","communications_application_session_controller = 3.9.0","communications_billing_and_revenue_management = 12.0.0.4","communications_billing_and_revenue_management = 12.0.0.5","communications_calendar_server = 8.0.0.5.0","communications_contacts_server = 8.0.0.3.0","communications_convergent_charging_controller >= 12.0.1.0.0, <= 12.0.4.0.0","communications_convergent_charging_controller = 6.0.1.0.0","communications_data_model = 11.3.2.1.0","communications_data_model = 11.3.2.2.0","communications_data_model = 11.3.2.3.0","communications_data_model = 12.1.0.1.0","communications_data_model = 12.1.2.0.0","communications_design_studio = 7.3.5","communications_design_studio = 7.4.0","communications_design_studio = 7.4.1","communications_design_studio = 7.4.2","communications_diameter_intelligence_hub >= 8.0.0, <= 8.2.3","communications_ip_service_activator = 7.4.0","communications_metasolv_solution = 6.3.1","communications_network_charging_and_control >= 12.0.1.0, <= 12.0.4.0.0","communications_network_charging_and_control = 6.0.1.0.0","communications_network_integrity = 7.3.5","communications_network_integrity = 7.3.6","communications_pricing_design_center = 12.0.0.4","communications_pricing_design_center = 12.0.0.5","communications_services_gatekeeper = 7.0","communications_session_report_manager >= 8.0.0, <= 8.2.5.0","communications_session_route_manager >= 8.2.0, <= 8.2.5","data_integrator = 12.2.1.3.0","data_integrator = 12.2.1.4.0","demantra_demand_management >= 12.2.6, <= 12.2.11","documaker >= 12.6.2, <= 12.6.4","documaker = 12.6.0","documaker = 12.7.0","enterprise_data_quality = 12.2.1.3.0","enterprise_data_quality = 12.2.1.4.0","enterprise_manager_base_platform = 13.4.0.0","enterprise_manager_base_platform = 13.5.0.0","enterprise_manager_ops_center = 12.4.0.0","financial_services_analytical_applications_infrastructure >= 8.0.7, <= 8.1.1","financial_services_behavior_detection_platform = 8.0.7","financial_services_behavior_detection_platform = 8.0.8","financial_services_behavior_detection_platform = 8.0.11","financial_services_enterprise_case_management = 8.0.7","financial_services_enterprise_case_management = 8.0.8","financial_services_enterprise_case_management = 8.0.11","financial_services_foreign_account_tax_compliance_act_management = 8.0.7","financial_services_foreign_account_tax_compliance_act_management = 8.0.8","financial_services_foreign_account_tax_compliance_act_management = 8.0.11","financial_services_model_management_and_governance >= 8.0.8.0.0, <= 8.1.1.0.0","financial_services_trade-based_anti_money_laundering = 8.0.7","financial_services_trade-based_anti_money_laundering = 8.0.8","flexcube_investor_servicing = 12.0.4"],"patched":["big_data_spatial_and_graph 23.1"],"published":"2021-07-21","updated":"2026-08-25","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-2351","references":[{"url":"http://packetstormsecurity.com/files/165255/Oracle-Database-Protection-Mechanism-Bypass.html","label":"secalert_us@oracle.com"},{"url":"http://packetstormsecurity.com/files/165258/Oracle-Database-Weak-NNE-Integrity-Key-Derivation.html","label":"secalert_us@oracle.com"},{"url":"http://seclists.org/fulldisclosure/2021/Dec/19","label":"secalert_us@oracle.com"},{"url":"http://seclists.org/fulldisclosure/2021/Dec/20","label":"secalert_us@oracle.com"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"secalert_us@oracle.com"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"secalert_us@oracle.com"},{"url":"https://www.oracle.com/security-alerts/cpujan2023.html","label":"secalert_us@oracle.com"},{"url":"https://www.oracle.com/security-alerts/cpujul2021.html","label":"secalert_us@oracle.com"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"secalert_us@oracle.com"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"secalert_us@oracle.com"},{"url":"http://packetstormsecurity.com/files/165255/Oracle-Database-Protection-Mechanism-Bypass.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/165258/Oracle-Database-Weak-NNE-Integrity-Key-Derivation.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2021/Dec/19","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2021/Dec/20","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2023.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.02432,"epssPercentile":0.83409,"ingestedAt":"2026-08-25T17:29:31.401Z","slug":"CVE-2021-2351","body":"## Overview\n\nVulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: \"Changes in Native Network Encryption with the July 2021 Critical Patch Update\" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).\n\n## Affected\n\n- `advanced_networking_option = 12.1.0.2`\n- `advanced_networking_option = 12.2.0.1`\n- `advanced_networking_option = 19c`\n- `agile_engineering_data_management = 6.2.1.0`\n- `agile_product_lifecycle_management = 9.3.6`\n- `agile_product_lifecycle_management_for_process = 6.2.2.0`\n- `agile_product_lifecycle_management_for_process = 6.2.3.0`\n- `airlines_data_model = 12.1.1.0.0`\n- `airlines_data_model = 12.2.0.1.0`\n- `application_performance_management = 13.4.1.0`\n- `application_performance_management = 13.5.1.0`\n- `application_testing_suite = 13.3.0.1`\n- `argus_analytics = 8.2.1`\n- `argus_analytics = 8.2.2`\n- `argus_analytics = 8.2.3`\n- `argus_insight = 8.2.1`\n- `argus_insight = 8.2.2`\n- `argus_insight = 8.2.3`\n- `argus_mart = 8.2.1`\n- `argus_mart = 8.2.2`\n- `argus_mart = 8.2.3`\n- `argus_safety = 8.2.1`\n- `argus_safety = 8.2.2`\n- `argus_safety = 8.2.3`\n- `banking_apis >= 18.1, <= 18.3`\n- `banking_apis = 19.1`\n- `banking_apis = 19.2`\n- `banking_apis = 20.1`\n- `banking_apis = 21.1`\n- `banking_digital_experience >= 18.1, <= 18.3`\n- `banking_digital_experience = 17.2`\n- `banking_digital_experience = 19.1`\n- `banking_digital_experience = 19.2`\n- `banking_digital_experience = 20.1`\n- `banking_digital_experience = 21.1`\n- `banking_enterprise_default_management = 2.10.0`\n- `banking_enterprise_default_management = 2.12.0`\n- `banking_platform = 2.6.2`\n- `banking_platform = 2.7.1`\n- `banking_platform = 2.12.0`\n- `big_data_spatial_and_graph < 23.1`\n- `blockchain_platform = 21.1.2`\n- `clinical = 5.2.1`\n- `clinical = 5.2.2`\n- `commerce_platform = 11.3.0`\n- `commerce_platform = 11.3.1`\n- `commerce_platform = 11.3.2`\n- `communications_application_session_controller = 3.9.0`\n- `communications_billing_and_revenue_management = 12.0.0.4`\n- `communications_billing_and_revenue_management = 12.0.0.5`\n- `communications_calendar_server = 8.0.0.5.0`\n- `communications_contacts_server = 8.0.0.3.0`\n- `communications_convergent_charging_controller >= 12.0.1.0.0, <= 12.0.4.0.0`\n- `communications_convergent_charging_controller = 6.0.1.0.0`\n- `communications_data_model = 11.3.2.1.0`\n- `communications_data_model = 11.3.2.2.0`\n- `communications_data_model = 11.3.2.3.0`\n- `communications_data_model = 12.1.0.1.0`\n- `communications_data_model = 12.1.2.0.0`\n- `communications_design_studio = 7.3.5`\n- `communications_design_studio = 7.4.0`\n- `communications_design_studio = 7.4.1`\n- `communications_design_studio = 7.4.2`\n- `communications_diameter_intelligence_hub >= 8.0.0, <= 8.2.3`\n- `communications_ip_service_activator = 7.4.0`\n- `communications_metasolv_solution = 6.3.1`\n- `communications_network_charging_and_control >= 12.0.1.0, <= 12.0.4.0.0`\n- `communications_network_charging_and_control = 6.0.1.0.0`\n- `communications_network_integrity = 7.3.5`\n- `communications_network_integrity = 7.3.6`\n- `communications_pricing_design_center = 12.0.0.4`\n- `communications_pricing_design_center = 12.0.0.5`\n- `communications_services_gatekeeper = 7.0`\n- `communications_session_report_manager >= 8.0.0, <= 8.2.5.0`\n- `communications_session_route_manager >= 8.2.0, <= 8.2.5`\n- `data_integrator = 12.2.1.3.0`\n- `data_integrator = 12.2.1.4.0`\n- `demantra_demand_management >= 12.2.6, <= 12.2.11`\n- `documaker >= 12.6.2, <= 12.6.4`\n- `documaker = 12.6.0`\n- `documaker = 12.7.0`\n- `enterprise_data_quality = 12.2.1.3.0`\n- `enterprise_data_quality = 12.2.1.4.0`\n- `enterprise_manager_base_platform = 13.4.0.0`\n- `enterprise_manager_base_platform = 13.5.0.0`\n- `enterprise_manager_ops_center = 12.4.0.0`\n- `financial_services_analytical_applications_infrastructure >= 8.0.7, <= 8.1.1`\n- `financial_services_behavior_detection_platform = 8.0.7`\n- `financial_services_behavior_detection_platform = 8.0.8`\n- `financial_services_behavior_detection_platform = 8.0.11`\n- `financial_services_enterprise_case_management = 8.0.7`\n- `financial_services_enterprise_case_management = 8.0.8`\n- `financial_services_enterprise_case_management = 8.0.11`\n- `financial_services_foreign_account_tax_compliance_act_management = 8.0.7`\n- `financial_services_foreign_account_tax_compliance_act_management = 8.0.8`\n- `financial_services_foreign_account_tax_compliance_act_management = 8.0.11`\n- `financial_services_model_management_and_governance >= 8.0.8.0.0, <= 8.1.1.0.0`\n- `financial_services_trade-based_anti_money_laundering = 8.0.7`\n- `financial_services_trade-based_anti_money_laundering = 8.0.8`\n- `flexcube_investor_servicing = 12.0.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `big_data_spatial_and_graph 23.1`","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":45.7,"likelihood":0.5,"exploitation":0,"ransomware":0},"changes":[]}