High 8.3HealthcarePublished Jul 20, 2021

CVE-2021-2351Vulnerability in the Advanced Networking Option component of Oracle Database Server.

Updated under an hour ago (Oct 27, 2026, 6:40 PM ET)

Does this affect you?

It affects Oracle Corporation WebLogic Server and 59 other products. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 2.43%, higher than 84% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Oracle Corporation WebLogic Server

Exploited in the last 30 days

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

CVSS: 8.3 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 2.43% (percentile 84)
Assigned by: oracle
NVD analysis: Modified
Record last updated: Aug 3, 2024
First seen by InfoSec Signals: Oct 12, 2026

Affected products

Affected products

Oracle Corporation WebLogic Server oracle:weblogic_server (from the name)	12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0	CNA record
oracle advanced_networking_option oracle:advanced_networking_option	12.1.0.2; 12.2.0.1; 19c	NVD
oracle agile_engineering_data_management oracle:agile_engineering_data_management	6.2.1.0	NVD
oracle agile_product_lifecycle_management oracle:agile_product_lifecycle_management	9.3.6	NVD
oracle agile_product_lifecycle_management_for_process oracle:agile_product_lifecycle_management_for_process	6.2.2.0; 6.2.3.0	NVD
oracle airlines_data_model oracle:airlines_data_model	12.1.1.0.0; 12.2.0.1.0	NVD
oracle application_performance_management oracle:application_performance_management	13.4.1.0; 13.5.1.0	NVD
oracle application_testing_suite oracle:application_testing_suite	13.3.0.1	NVD
oracle argus_analytics oracle:argus_analytics	8.2.1; 8.2.2; 8.2.3	NVD
oracle argus_insight oracle:argus_insight	8.2.1; 8.2.2; 8.2.3	NVD
1–10 of 60

References

References

https://www.oracle.com/security-alerts/cpujul2021.html	x-refsource-misc, patch, vendor-advisory
https://www.oracle.com/security-alerts/cpuoct2021.html	x-refsource-misc, patch, vendor-advisory
http://seclists.org/fulldisclosure/2021/Dec/19	mailing-list, x-refsource-fulldisc, exploit, third-party-advisory
http://seclists.org/fulldisclosure/2021/Dec/20	mailing-list, x-refsource-fulldisc, exploit, third-party-advisory
https://www.oracle.com/security-alerts/cpujan2022.html	x-refsource-misc, patch, vendor-advisory
http://packetstormsecurity.com/files/165258/Oracle-Database-Weak-NNE-Integrity-Key-Derivation.html	x-refsource-misc, exploit, third-party-advisory, vdb-entry
http://packetstormsecurity.com/files/165255/Oracle-Database-Protection-Mechanism-Bypass.html	x-refsource-misc, exploit, third-party-advisory, vdb-entry
https://www.oracle.com/security-alerts/cpuapr2022.html	x-refsource-misc, patch, vendor-advisory
https://www.oracle.com/security-alerts/cpujul2022.html	x-refsource-misc, vendor-advisory
https://www.oracle.com/security-alerts/cpujan2023.html	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.