Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

oracle CPUJan2026: Business Intelligence Enterprise Edition

The 13.5 and 24.1 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Agent Next Gen (Apache Commons Lang)). Supported versions that are affected are 13.5 and 24.1.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Manager Base     Platform. (CVE-2025-48924)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Gateway (Eclipse Jetty)). The supported version that is affected is 24.1. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise     Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may     significantly impact additional products (scope change). Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform     accessible data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform     accessible data.  Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle     Enterprise Manager (component: Oracle Enterprise Manager Base Platform - Agent Next Gen (Eclipse Jetty)).
    Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base     Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly     impact additional products (scope change). Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible     data as well as unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible     data. (CVE-2024-13009)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Application Testing Suite installed on the remote host are affected by a vulnerability as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (Apache Commons Lang)). The supported version that is affected is 13.3.0.1.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Testing     Suite. (CVE-2025-48924)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 7.6.0.0.0 and 8.2.0.0.0 versions of Oracle Business Intelligence Publisher installed on the remote host are affected by a vulnerability as referenced in the January 2026 CPU advisory.

  - Security-in-Depth issue in the Oracle BI Publisher product of Oracle Analytics (component: Development     Operations (Apache Tomcat)). The Spring Framework annotation detection mechanism may not correctly resolve annotations     on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such     annotations are used for authorization decisions. Your application may be affected by this if you are using Spring     Security's @EnableMethodSecurity feature. (CVE-2025-41249)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 7.6.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Platform Security (OpenSSL)). Supported versions that are affected are 7.6.0.0.0, 8.2.0.0.0     and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access     via TLS to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2025-9230)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (jackson-core)). Supported versions that are affected are 7.6.0.0.0 and     8.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2025-52999)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Oracle Analytics Cloud). Supported versions that are affected are 7.6.0.0.0 and 8.2.0.0.0.     Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where     Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Oracle Business Intelligence Enterprise     Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle     Business Intelligence Enterprise Edition accessible data. (CVE-2026-21976)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition 12.2.1.4 installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (json-smart)). Supported versions that are affected are 7.6.0.0.0, 8.2.0.0.0     and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2024-57699)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache POI)). Supported versions that are affected are 7.6.0.0.0, 8.2.0.0.0     and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     multiple protocols to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of     this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS)     of Oracle Business Intelligence Enterprise Edition. (CVE-2025-31672)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Platform Security (Apache Commons Lang)). Supported versions that are affected are 7.6.0.0.0,     8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 8.2.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Core (Apache XMLBeans)). The supported version that is affected is 8.2.0.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise     Edition accessible data and unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2021-23926)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (jackson-core)). Supported versions that are affected are 7.6.0.0.0 and     8.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2025-52999)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Oracle Analytics Cloud). Supported versions that are affected are 7.6.0.0.0 and 8.2.0.0.0.     Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where     Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Oracle Business Intelligence Enterprise     Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle     Business Intelligence Enterprise Edition accessible data. (CVE-2026-21976)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 versions of Identity Manager installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Third Party     (Apache Commons Lang)). The supported version that is affected is 12.2.1.4.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity     Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial     denial of service (partial DOS) of Oracle Identity Manager. (CVE-2025-48924)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Process Management Suite installed on the remote host is affected by a vulnerability, as referenced in the January 2026 CPU advisory:

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Composer (Apache Commons Lang)). The supported version that is affected is 14.1.2.0.0.     Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business     Process Management Suite. (CVE-2025-48924)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Composer (Apache Commons FileUpload)). Supported versions that are affected are 12.2.1.4.0     and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle      Business Process Management Suite. (CVE-2025-48976)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Oracle Business Rules (Apache Commons Compress)). The supported version that is affected is     14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can     result in takeover of Oracle Business Process Management Suite. (CVE-2025-54988)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Runtime Engine (Apache Tika)). Supported versions that are affected are 12.2.1.4.0 and     14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Process Management Suite. While the vulnerability is in Oracle     Business Process Management Suite, attacks may significantly impact additional products (scope change).     Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management     Suite. (CVE-2025-66516)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 and 14.1.2.0.0 versions of WebCenter Sites installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Core (Apache     Log4j)). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Oracle WebCenter Sites. (CVE-2021-45105)

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Core (Spring     Security)). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful     attacks of this vulnerability can result in unauthorized access to critical data or complete access to all     Oracle WebCenter Sites accessible data. (CVE-2025-41248)

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Core (Apache     Commons Lang)). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter     Sites. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial     denial of service (partial DOS) of Oracle WebCenter Sites. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 and 14.1.2.1.0 versions of Access Manager installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Webserver     Plugin (Intel C++ Compiler Classic)). The supported version that is affected is 12.2.1.4.0. Easily     exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle     Access Manager executes to compromise Oracle Access Manager. Successful attacks of this vulnerability can     result in takeover of Oracle Access Manager. (CVE-2022-40196, CVE-2022-41342)

  - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Identity Store     Access (Apache Commons Lang)). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle Access Manager. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface     (jquery-cookie)). Supported versions that are affected are 17.0-25.9. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.
    Successful attacks require human interaction from a person other than the attacker and while the     vulnerability is in Siebel CRM Deployment, attacks may significantly impact additional products (scope     change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of Siebel CRM Deployment accessible data as well as unauthorized read access to a subset of     Siebel CRM Deployment accessible data. (CVE-2022-23395)

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI (Apache     Xerces-C++)). Supported versions that are affected are 17.0-25.9. Easily exploitable vulnerability allows     high privileged attacker with network access via HTTP to compromise Siebel CRM Integration. Successful     attacks of this vulnerability can result in takeover of Siebel CRM Integration. (CVE-2024-23807)

  - Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing     (Apache Commons FileUpload)). Supported versions that are affected are 17.0-25.9. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps -     Marketing. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Siebel Apps - Marketing. (CVE-2025-48976)

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure     (Bouncy Castle Java Library)). Supported versions that are affected are 17.0-25.9. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM     Deployment. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial     denial of service (partial DOS) of Siebel CRM Deployment. (CVE-2025-8916)

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST (Apache Commons     Lang)). Supported versions that are affected are 17.0-25.9. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful     attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service     (partial DOS) of Siebel CRM Integration. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991256 advisory.

    Uncontrolled Recursion vulnerability in Apache Commons Lang.

    This issue affects Apache Commons Lang: Starting withcommons-lang:commons-lang2.0 to 2.6, and, from     org.apache.commons:commons-lang3 3.0 before3.18.0.

    The methods ClassUtils.getClass(...) can throwStackOverflowError on very long inputs. Because an Error     is usually not handled by applications and libraries, a     StackOverflowError couldcause an application to stop.

    Users are recommended to upgrade to version 3.18.0, which fixes the issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02785-1 advisory.

    - CVE-2025-48924: Fixed an uncontrolled recursion vulnerability that may lead to a DoS. (bsc#1246397)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:02786-1 advisory.

    - CVE-2025-48924: Fixed an uncontrolled recursion vulnerability that may lead to a DoS. (bsc#1246397)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4286 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4286-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     August 31, 2025                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libcommons-lang3-java     Version        : 3.11-1+deb11u1     CVE ID         : CVE-2025-48924     Debian Bug     : 1109125

    A vulnerability has been discovered in libcommons-lang3-java, a set of     Java classes that provide helper methods for standard Java classes.

    CVE-2025-48924

     An uncontrolled recursion vulnerability was discovered in      ClassUtils.getClass() that could lead to a StackOverflowError on      very long inputs.

    For Debian 11 bullseye, this problem has been fixed in version     3.11-1+deb11u1.

    We recommend that you upgrade your libcommons-lang3-java packages.

    For the detailed security status of libcommons-lang3-java please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libcommons-lang3-java

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Essbase installed on the remote host is missing a security patch from the October 2025 Critical Patch Update (CPU). It is, therefore, affected by:

  - Vulnerability in Oracle Essbase (component: Security and Provisioning (Bouncy Castle Java Library)). The     supported version that is affected is 21.7.3.0.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Oracle Essbase. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Essbase. (CVE-2025-8916)

  - Vulnerability in Oracle Essbase (component: Security and Provisioning (Nimbus JOSE+JWT)). The supported     version that is affected is 21.7.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase,     attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Essbase. (CVE-2025-53864)

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is     affected is 21.7.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network     access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Oracle Essbase accessible     data as well as unauthorized access to critical data or complete access to all Oracle Essbase accessible     data. (CVE-2025-61763)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (GlassFish Server)). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and     14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the     infrastructure where Oracle WebLogic Server executes to compromise Oracle WebLogic Server. Successful     attacks require human interaction from a person other than the attacker. Successful attacks of this     vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic     Server accessible data. (CVE-2020-15250)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
    Supported versions that are affected are 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle WebLogic Server. (CVE-2025-61752)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
    Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of     Oracle WebLogic Server accessible data. (CVE-2025-61764)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (Apache Commons Lang)). The supported version that is affected is 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle WebLogic Server. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Enterprise Security API for Java (Legacy))). Supported versions that are affected are 20.12.0-20.12.16,     21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.15 and 24.12.0-24.12.9. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTPS to compromise Primavera Unifier. Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of     Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier     accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera     Unifier. (CVE-2025-5878)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (FreeType)). Supported versions that are affected are 20.12.0-20.12.16, 21.12.0-21.12.17,     22.12.0-22.12.15, 23.12.0-23.12.15 and 24.12.0-24.12.9. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks     of this vulnerability can result in takeover of Primavera Unifier. (CVE-2025-27363)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (Apache Commons FileUpload)). Supported versions that are affected are 20.12.0-20.12.16,     21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.15 and 24.12.0-24.12.9. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Primavera Unifier. (CVE-2025-48976)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Apache Commons Lang)). Supported versions that are affected are 20.12.0-20.12.16, 21.12.0-21.12.17,     22.12.0-22.12.15, 23.12.0-23.12.15 and 24.12.0-24.12.9. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks     of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial     DOS) of Primavera Unifier. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Apache Commons VFS)). Supported versions that are affected are 20.12.0-20.12.17 and 21.12.0-21.12.15. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Primavera Gateway accessible data. (CVE-2025-27553)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component:
    Admin (Apache Commons Lang)). Supported versions that are affected are 20.12.0-20.12.17 and     21.12.0-21.12.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Primavera Gateway. (CVE-2025-48924)


Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 versions of WebCenter Portal installed on the remote host are affected by a vulnerability as referenced in the October 2025 CPU advisory.

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portal,     Analytics and REST (Apache Commons Lang)). The supported version that is affected is 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle WebCenter Portal. (CVE-2025-48924)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986100 advisory.

    Uncontrolled Recursion vulnerability in Apache Commons Lang.

    This issue affects Apache Commons Lang: Starting withcommons-lang:commons-lang2.0 to 2.6, and, from     org.apache.commons:commons-lang3 3.0 before3.18.0.

    The methods ClassUtils.getClass(...) can throwStackOverflowError on very long inputs. Because an Error     is usually not handled by applications and libraries, a     StackOverflowError couldcause an application to stop.

    Users are recommended to upgrade to version 3.18.0, which fixes the issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1149 advisory.

    Uncontrolled Recursion vulnerability in Apache Commons Lang.

    This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from     org.apache.commons:commons-lang3 3.0 before 3.18.0.

    The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is     usually not handled by applications and libraries, aStackOverflowError could cause an application to stop.

    Users are recommended to upgrade to version 3.18.0, which fixes the issue. (CVE-2025-48924)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1150 advisory.

    Uncontrolled Recursion vulnerability in Apache Commons Lang.

    This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from     org.apache.commons:commons-lang3 3.0 before 3.18.0.

    The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is     usually not handled by applications and libraries, aStackOverflowError could cause an application to stop.

    Users are recommended to upgrade to version 3.18.0, which fixes the issue. (CVE-2025-48924)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02818-1 advisory.

    - Update to version 3.18.0
    - CVE-2025-48924: Fixed an uncontrolled recursion vulnerability that may lead to a DoS. (bsc#1246397)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang:
    Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before     3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an     Error is usually not handled by applications and libraries, a StackOverflowError could cause an     application to stop. Users are recommended to upgrade to version 3.18.0, which fixes the issue.
    (CVE-2025-48924)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4262 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4262-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     August 01, 2025                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libcommons-lang-java     Version        : 2.6-9+deb11u1     CVE ID         : CVE-2025-48924     Debian Bug     : 1109126

    A vulnerability has been discovered in libcommons-lang-java, a set of     Java classes that provide helper methods for standard Java classes.

    CVE-2025-48924

       An uncontrolled recursion vulnerability was discovered in        ClassUtils.getClass() that could lead to a StackOverflowError on        very long inputs.

    For Debian 11 bullseye, this problem has been fixed in version     2.6-9+deb11u1.

    We recommend that you upgrade your libcommons-lang-java packages.

    For the detailed security status of libcommons-lang-java please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libcommons-lang-java

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
297820	Oracle Enterprise Manager Cloud Control (January 2026 CPU)	Nessus	Misc.	high
297691	Oracle Application Testing Suite (January 2026 CPU)	Nessus	Misc.	medium
296415	Oracle Business Intelligence Publisher (January 2026 CPU)	Nessus	Misc.	high
296370	Oracle Business Intelligence Enterprise Edition (OAS 7.6) (January 2026 CPU)	Nessus	Misc.	high
296369	Oracle Business Intelligence Enterprise Edition (12.2.1.4) (January 2026 CPU)	Nessus	Misc.	medium
296368	Oracle Business Intelligence Enterprise Edition (OAS 8.2) (January 2026 CPU)	Nessus	Misc.	high
296247	Oracle Identity Manager (January 2026 CPU)	Nessus	Misc.	medium
294978	Oracle Business Process Management Suite (14.1.2.0.0) (January 2026 CPU)	Nessus	Misc.	critical
294976	Oracle WebCenter Sites (January 2026 CPU)	Nessus	Windows	medium
294970	Oracle Access Manager (January 2026 CPU)	Nessus	Misc.	high
294868	Oracle Siebel Server <= 25.9 (January 2026 CPU)	Nessus	Misc.	medium
278941	Unity Linux 20.1070e Security Update: apache-commons-lang3 (UTSA-2025-991256)	Nessus	Unity Linux Local Security Checks	medium
278703	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : apache-commons-lang3 (SUSE-SU-2025:02785-1)	Nessus	SuSE Local Security Checks	medium
278695	SUSE SLES12 Security Update : apache-commons-lang3 (SUSE-SU-2025:02786-1)	Nessus	SuSE Local Security Checks	medium
278661	Debian dla-4286 : libcommons-lang3-java - security update	Nessus	Debian Local Security Checks	medium
271378	Oracle Essbase Multiple Vulnerabilities (October 2025 CPU)	Nessus	Misc.	high
271253	Oracle WebLogic Server (October 2025 CPU)	Nessus	Misc.	high
271244	Oracle Primavera Unifier (October 2025 CPU)	Nessus	CGI abuses	medium
271242	Oracle Primavera Gateway (October 2025 CPU)	Nessus	CGI abuses	high
271206	Oracle WebCenter Portal (October 2025 CPU)	Nessus	Misc.	medium
268511	Unity Linux 20.1070e Security Update: apache-commons-lang (UTSA-2025-986100)	Nessus	Unity Linux Local Security Checks	medium
251384	Amazon Linux 2023 : javapackages-bootstrap (ALAS2023-2025-1149)	Nessus	Amazon Linux Local Security Checks	medium
251372	Amazon Linux 2023 : apache-commons-lang3 (ALAS2023-2025-1150)	Nessus	Amazon Linux Local Security Checks	medium
250301	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : apache-commons-lang3 (SUSE-SU-2025:02818-1)	Nessus	SuSE Local Security Checks	medium
246337	Linux Distros Unpatched Vulnerability : CVE-2025-48924	Nessus	Misc.	medium
243262	Debian dla-4262 : libcommons-lang-java - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2025-48924

medium

Tenable Plugins

Coming Soon

high

medium

high

high

medium

high

medium

critical

medium

high

medium

medium

medium

medium

medium

high

high

medium

high

medium

medium

medium

medium

medium

medium

medium