CVE-2021-2351
HighCVSS 8.3Exploitation Probability (EPSS)
High risk83th percentile - higher than 83% of all known CVEs
Summary
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Affected versions are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit, allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction and may significantly impact additional products. Successful attacks can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces Native Network Encryption changes to address this vulnerability. CVSS 3.1 Base Score 8.3.
Risk Assessment
The vulnerability may allow an attacker to take over the Advanced Networking Option, potentially leading to confidentiality, integrity, and availability impacts, and affecting other products.
Recommendation
Apply the July 2021 Critical Patch Update and review the documentation 'Changes in Native Network Encryption with the July 2021 Critical Patch Update' (Doc ID 2791571.1).
Other vulnerabilities in Oracle Database Server
See all- CVE-2026-71064Critical
Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.
- CVE-2026-71063Critical
Vulnerability in the Portable Clusterware component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. An unauthenticated attacker with access to the physical communication segment can take over the component. CVSS score is 9.6.
- CVE-2026-61211Critical
Vulnerability in the RDBMS component of Oracle Database Server (versions 19.3-19.31 and 23.4.0-23.26.2) allows a low-privileged attacker with network access via Oracle Net to compromise RDBMS. Attacks may impact additional products (scope change). CVSS 9.9.
- CVE-2026-46833Critical
Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. Difficult to exploit, allows unauthenticated attacker with network access via TLS to compromise Net Service. Attacks may impact additional products (scope change).
- CVE-2026-83351High
Vulnerability in the RDBMS component of Oracle Database Server affecting versions 23.4.0-23.26.3. A difficult to exploit flaw allows an unauthenticated attacker with network access via Oracle Net to compromise RDBMS.
- CVE-2026-83348High
Vulnerability in the RDBMS component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. An easily exploitable flaw allows a low-privileged attacker having Create DB Link privilege with network access via Oracle Net to compromise RDBMS.
- CVE-2026-83272High
Vulnerability in the Oracle Text component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. A low-privileged attacker with Create Index privilege and network access via Oracle Net can compromise Oracle Text. The vulnerability is difficult to exploit but may impact additional products (scope change).
- CVE-2026-83271High
Vulnerability in the RDBMS component of Oracle Database Server affects versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. A low-privileged attacker with Execute on DBMS_REDEFINITION privilege and network access via Oracle Net can compromise RDBMS. The vulnerability is easily exploitable.
- CVE-2026-83160High
Vulnerability in the RDBMS component of Oracle Database Server in versions 23.4.0-23.26.3. Easily exploitable, allows attacker with Create Table privilege via Oracle Net to take over RDBMS.
- CVE-2026-83156High
Vulnerability in the Oracle XML Developers Kit component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. A low-privileged attacker with XDKC privilege and network access via Oracle Net can take over Oracle XML Developers Kit.
Original NVD description (English source)
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS