The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass. Your application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature. You are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces. This CVE is published in conjunction with CVE-2025-41249 https://spring.io/security/cve-2025-41249 .

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within
    type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using
    @PreAuthorize and other method security annotations, resulting in an authorization bypass. Your
    application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature. You
    are not affected by this if you are not using @EnableMethodSecurity or if you do not use security
    annotations on methods in generic superclasses or generic interfaces. This CVE is published in conjunction
    with CVE-2025-41249 https://spring.io/security/cve-2025-41249 . (CVE-2025-41248)

The 12.2.1.4.0 and 14.1.2.0.0 versions of WebCenter Sites installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Core (Apache     Log4j)). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Oracle WebCenter Sites. (CVE-2021-45105)

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Core (Spring     Security)). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful     attacks of this vulnerability can result in unauthorized access to critical data or complete access to all     Oracle WebCenter Sites accessible data. (CVE-2025-41248)

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Core (Apache     Commons Lang)). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter     Sites. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial     denial of service (partial DOS) of Oracle WebCenter Sites. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16466 advisory.

  - The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within     type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using     @PreAuthorize and other method security annotations, resulting in an authorization bypass. Your     application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature. You     are not affected by this if you are not using @EnableMethodSecurity or if you do not use security     annotations on methods in generic superclasses or generic interfaces. This CVE is published in conjunction     with CVE-2025-41249 https://spring.io/security/cve-2025-41249 . (CVE-2025-41248)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-101485 advisory.

  - The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within     type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using     @PreAuthorize and other method security annotations, resulting in an authorization bypass. Your     application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature. You     are not affected by this if you are not using @EnableMethodSecurity or if you do not use security     annotations on methods in generic superclasses or generic interfaces. This CVE is published in conjunction     with CVE-2025-41249 https://spring.io/security/cve-2025-41249 . (CVE-2025-41248)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
464733	Echo: org.springframework.security:spring-security-core: security update to 6.5.0+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
464733	Echo: org.springframework.security:spring-security-core: security update to 6.5.0+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
294976	Oracle WebCenter Sites (January 2026 CPU)	Nessus	Windows	Local	medium
293770	Atlassian Jira Service Management Data Center and Server 11.0.x < 11.2.0 (JSDSERVER-16466)	Nessus	Misc.	Local	high
282322	Atlassian Confluence 10.1.x< 10.1.1 (CONFSERVER-101485)	Nessus	CGI abuses	Combined	high
435340	SCA: security update for org.springframework.security:spring-security-core (GHSA-8v5q-rhf3-jphm)	Tenable Cloud Security	SCA Checks	Local	high
435340	SCA: security update for org.springframework.security:spring-security-core (GHSA-8v5q-rhf3-jphm)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2025-41248

high

Tenable Plugins

high

high

medium

high

high

high

high