← Vulnerability feed

Vulnerability record · CVE-2021-2018 · published 20 January 2021

CVE-2021-2018: Oracle advanced networking option vulnerability

Oracle · Advanced Networking Option

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 18c and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: CVE-2021-2018 affects Windows platform only. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

8.3 CVSS 3.1 High EPSS 1.4% · top 27.9%
8.3CVSS 3.1 base score, v2 5.1
1.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
6Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 18c and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: CVE-2021-2018 affects Windows platform only. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.oracle.com/security-alerts/cpujan2021.html Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Vendor Advisory

Track CVE-2021-2018 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-47056Oracle data integrator missing authentication for critical function vulnerabilityVulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Service). Supported versions that are affected are 1…EPSS 0.51%9.9CVE-2024-21010Oracle hospitality simphony incorrect authorization vulnerabilityVulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: Simphony Enterprise Server). Supported …EPSS 0.74%9.9CVE-2024-20997Oracle hospitality simphony vulnerabilityVulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: Simphony Enterprise Server). Supported …EPSS 0.83%9.8CVE-2026-60999Oracle data integrator improper access control vulnerabilityVulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Service). The supported version that is affected is …EPSS 0.51%9.8CVE-2024-21014Oracle hospitality simphony missing authentication for critical function vulnerabilityVulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: Simphony Enterprise Server). Supported …EPSS 0.85%9.8CVE-2018-1285Apache log4net xml external entity (xxe) vulnerabilityApache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attack…EPSS 17%9.8CVE-2020-10683Dom4j project dom4j xml external entity (xxe) vulnerabilitydom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is po…EPSS 7.3%9.8CVE-2019-17195Connect2id nimbus jose\+jwt vulnerabilityConnect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potenti…EPSS 11%

Source: NIST National Vulnerability Database (record CVE-2021-2018), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.