CVE-2021-2351

mediumpriority · track · 21OT risk · elevatedEPSS 0.024 · 84 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

2.43% (84th) EPSS

CVSS 5.1 · medium

Is it mine?

277 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

cvss

Technical severity, 0–10. One row per scoring source.

8.3

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.3–8.3

v2.05.1mediumAV:N/AC:H/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 4.9 · impact 6.4

v2.04.3mediumAV:N/AC:H/Au:N/C:P/I:P/A:P/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · NVD / NIST USexploitability 1.6 · impact 5.9

v3.18.3highAV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.3highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.3highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · secalert_us@oracle.com USexploitability 1.6 · impact 6

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-327USprimaryCWE-384USprimaryCWE-20USCWE-287US

affected products (277)

Products and version ranges known to be affected.

Oracle iLearning 6.3.1all versionscert_bundDEcpe:/a:oracle:ilearning:6.3.1
Oracle Corporation WebLogic Server≤ 12.2.1.4.0enisa_euvdEU
Oracle Corporation WebLogic Server≤ 14.1.1.0.0enisa_euvdEU
Oracle Corporation WebLogic Server≤ 12.2.1.3.0enisa_euvdEU
IBM Corp. IBM Emptoris Contract Management10.1.0.0 → 10.1.0.39fstec_bduRU
IBM Corp. IBM Emptoris Contract Management10.1.1.0 → 10.1.1.36fstec_bduRU
IBM Corp. IBM Emptoris Contract Management10.1.3.0 → 10.1.3.31fstec_bduRU
IBM Corp. IBM Emptoris Strategic Supply Management Platform10.1.0.0 → 10.1.0.39fstec_bduRU
IBM Corp. IBM Emptoris Strategic Supply Management Platform10.1.1.0 → 10.1.1.36fstec_bduRU
IBM Corp. IBM Emptoris Strategic Supply Management Platform10.1.3.0 → 10.1.3.31fstec_bduRU
Oracle Corp. Communications Application Session Controller≤ 3.9fstec_bduRU
Oracle Corp. Communications MetaSolv Solution≤ 6.3.1fstec_bduRU
Oracle Corp. Database Server≤ 12.2.0.1fstec_bduRU
Oracle Corp. Database Server≤ 12.1.0.2fstec_bduRU
Oracle Corp. Database Server≤ 19cfstec_bduRU
Oracle Corp. Instantis EnterpriseTrack≤ 17.1fstec_bduRU
Oracle Corp. Instantis EnterpriseTrack≤ 17.2fstec_bduRU
Oracle Corp. Instantis EnterpriseTrack≤ 17.3fstec_bduRU
Oracle Corp. Oracle Communications Session Report Manager8.0.0.0 → 8.2.5.0fstec_bduRU
Oracle Corp. Oracle Communications Session Route Manager8.2.0.0 → 8.2.5.0fstec_bduRU

showing 20 of 277

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-1013Oracle iLearning: Mehrere SchwachstellenDeutsch2023-04-18csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Oracle iLearning ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund NVD CVE.org MITRE

published 2021-07-21modified 2026-08-25

related (1,524)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-102489US	critical9.8OT critical	1.96% (80th)	KEV	2026-09-30
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to ver…
CVE-2023-22518US	critical9.8OT critical	100.0% (100th)	KEV	2023-10-31
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to re…
CVE-2023-34039US	critical9.8OT high	67.2% (99th)	Exploit	2023-08-29
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Ope…
CVE-2016-2183US	high7.5OT high	94.7% (100th)	Exploit	2016-09-01
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which mak…
CVE-2018-11714US	critical9.8	67.1% (99th)	Exploit	2018-06-04
An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices. T…

+1519 more

references (44)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan