Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation.

The remote Windows host is missing security update 5087539 or hotpatch 5087423. It is, therefore, affected by multiple vulnerabilities

  - Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a     network. (CVE-2026-41096)

  - Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a     network. (CVE-2026-41089)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
    (CVE-2026-40403)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5087544. It is, therefore, affected by multiple vulnerabilities

  - Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over     an adjacent network. (CVE-2026-34329)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
    (CVE-2026-40403)

  - Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
    (CVE-2026-40415)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5087545 or hotpatch 5087424. It is, therefore, affected by multiple vulnerabilities

  - Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a     network. (CVE-2026-41089)

  - Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.
    (CVE-2026-40402)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
    (CVE-2026-40403)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5087420. It is, therefore, affected by multiple vulnerabilities

  - Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a     network. (CVE-2026-41096)

  - Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.
    (CVE-2026-40402)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
    (CVE-2026-40403)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5087537. It is, therefore, affected by multiple vulnerabilities

  - Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a     network. (CVE-2026-41089)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
    (CVE-2026-40403)

  - Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over     an adjacent network. (CVE-2026-34329)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5087541. It is, therefore, affected by multiple vulnerabilities

  - Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a     network. (CVE-2026-41096)

  - Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a     network. (CVE-2026-41089)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
    (CVE-2026-40403)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5087538. It is, therefore, affected by multiple vulnerabilities

  - Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a     network. (CVE-2026-41089)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
    (CVE-2026-40403)

  - Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over     an adjacent network. (CVE-2026-34329)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5089548. It is, therefore, affected by multiple vulnerabilities

  - Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a     network. (CVE-2026-41096)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
    (CVE-2026-40403)

  - Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over     an adjacent network. (CVE-2026-34329)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5089549 or hotpatch 5089466. It is, therefore, affected by multiple vulnerabilities

  - Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a     network. (CVE-2026-41096)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
    (CVE-2026-40403)

  - Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over     an adjacent network. (CVE-2026-34329)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50260 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in     ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF. (CVE-2025-40135)

  - This vulnerability was found and addressed by AMD. We are documenting it in the Security Update Guide to     encourage customers to install the May 2026 version of Windows as soon as possible. The vulnerability     assigned to this CVE is in certain processor models offered by AMD. The mitigation for this vulnerability     requires a Windows update. This CVE is being documented in the Security Update Guide to announce that the     latest builds of Windows enable the mitigation and provide protection against the vulnerability. Please     see the following for more information: AMD-SB-7052 (CVE-2025-54518)

  - In the Linux kernel, the following vulnerability has been resolved: dst: fix races in     rt6_uncached_list_del() and rt_del_uncached_list() syzbot was able to crash the kernel in     rt6_uncached_list_flush_dev() in an interesting way [1] Crash happens in list_del_init()/INIT_LIST_HEAD()     while writing list->prev, while the prior write on list->next went well. static inline void     INIT_LIST_HEAD(struct list_head *list) { WRITE_ONCE(list->next, list); // This went well     WRITE_ONCE(list->prev, list); // Crash, @list has been freed. } Issue here is that rt6_uncached_list_del()     did not attempt to lock ul->lock, as list_empty(&rt->dst.rt_uncached) returned true because the     WRITE_ONCE(list->next, list) happened on the other CPU. We might use list_del_init_careful() and     list_empty_careful(), or make sure rt6_uncached_list_del() always grabs the spinlock whenever     rt->dst.rt_uncached_list has been set. A similar fix is neeed for IPv4. [1] BUG: KASAN: slab-use-after-     free in INIT_LIST_HEAD include/linux/list.h:46 [inline] BUG: KASAN: slab-use-after-free in list_del_init     include/linux/list.h:296 [inline] BUG: KASAN: slab-use-after-free in rt6_uncached_list_flush_dev     net/ipv6/route.c:191 [inline] BUG: KASAN: slab-use-after-free in rt6_disable_ip+0x633/0x730     net/ipv6/route.c:5020 Write of size 8 at addr ffff8880294cfa78 by task kworker/u8:14/3450 CPU: 0 UID: 0     PID: 3450 Comm: kworker/u8:14 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: netns     cleanup_net Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description     mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150     mm/kasan/report.c:595 INIT_LIST_HEAD include/linux/list.h:46 [inline] list_del_init     include/linux/list.h:296 [inline] rt6_uncached_list_flush_dev net/ipv6/route.c:191 [inline]     rt6_disable_ip+0x633/0x730 net/ipv6/route.c:5020 addrconf_ifdown+0x143/0x18a0 net/ipv6/addrconf.c:3853     addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1 notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85     call_netdevice_notifiers_extack net/core/dev.c:2268 [inline] call_netdevice_notifiers net/core/dev.c:2282     [inline] netif_close_many+0x29c/0x410 net/core/dev.c:1785 unregister_netdevice_many_notify+0xb50/0x2330     net/core/dev.c:12353 ops_exit_rtnl_list net/core/net_namespace.c:187 [inline] ops_undo_list+0x3dc/0x990     net/core/net_namespace.c:248 cleanup_net+0x4de/0x7b0 net/core/net_namespace.c:696 process_one_work     kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340     worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463     ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30     arch/x86/entry/entry_64.S:246 </TASK> Allocated by task 803: kasan_save_stack mm/kasan/common.c:57     [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340     [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253     [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5263 [inline]     kmem_cache_alloc_noprof+0x18d/0x6c0 mm/slub.c:5270 dst_alloc+0x105/0x170 net/core/dst.c:89 ip6_dst_alloc     net/ipv6/route.c:342 [inline] icmp6_dst_alloc+0x75/0x460 net/ipv6/route.c:3333 mld_sendpack+0x683/0xe60     net/ipv6/mcast.c:1844 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60     net/ipv6/mcast.c:2693 process_one_work kernel/workqueue.c:3257 [inline]     process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0     kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50     arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entr ---truncated---     (CVE-2026-23004)

  - In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in     tls_sw_cancel_work_tx() This issue was discovered during a code audit. After cancel_delayed_work_sync() is     called from tls_sk_proto_close(), tx_work_handler() can still be scheduled from paths such as the Delayed     ACK handler or ksoftirqd. As a result, the tx_work_handler() worker may dereference a freed TLS object.
    The following is a simple race scenario: cpu0 cpu1 tls_sk_proto_close() tls_sw_cancel_work_tx()     tls_write_space() tls_sw_write_space() if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask))     set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask); cancel_delayed_work_sync(&ctx->tx_work.work);
    schedule_delayed_work(&tx_ctx->tx_work.work, 0); To prevent this race condition,     cancel_delayed_work_sync() is replaced with disable_delayed_work_sync(). (CVE-2026-23240)

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in     ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a     mismatched user MAD header size and RMPP header length, data_len can become negative and reach     ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-     bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating     the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in     ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task     spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80     (CVE-2026-23243)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50261 advisory.

    - xfrm: esp: ipv4: fix up flags setting (Greg Kroah-Hartman)  [Orabug: 39344515]  {CVE-2026-43284}
    - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344515]     {CVE-2026-43284}
    - x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39327141]  {CVE-2025-54518}
    - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)  [Orabug: 39250686]  {CVE-2026-31431}
    - x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov) [Orabug: 39241228,39273722] {CVE-2026-31628}
    - net/handshake: duplicate handshake cancellations leak socket (Scott Mayhew) [Orabug: 38847720]     {CVE-2025-68775}
    - ipv6: use RCU in ip6_xmit() (Eric Dumazet) [Orabug: 38649062] {CVE-2025-40135}
    - scsi: qla2xxx: Sanitize payload size to prevent member overflow (Jiasheng Jiang) [Orabug: 38930868]     {CVE-2026-23059}
    - bpf: Fix reference count leak in bpf_prog_test_run_xdp() (Tetsuo Handa) [Orabug: 38887702]     {CVE-2026-22994}
    - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [Orabug: 38887682]     {CVE-2026-22989}
    - net/mlx5e: TC, delete flows only for existing peers (Mark Bloch) [Orabug: 38970398] {CVE-2026-23173}
    - net/handshake: restore destructor on submit failure (Caoping) [Orabug: 38887601] {CVE-2025-71148}
    - scsi: qla2xxx: Fix improper freeing of purex item (Zilin Guan) [Orabug: 38798929] {CVE-2025-68741}
    - bnxt_en: Fix XDP_TX path (Michael Chan) [Orabug: 38847684] {CVE-2025-68770}
    - perf/x86/amd: Check event before enable to avoid GPF (George Kennedy) [Orabug: 38847849]     {CVE-2025-68798}
    - scsi: smartpqi: Fix device resources accessed after device removal (Mike Mcgowen) [Orabug: 38798848]     {CVE-2025-68371}
    - KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (Omar Sandoval) [Orabug: 38773579]     {CVE-2025-68259}
    - x86/fpu: Ensure XFD state on signal delivery (Chang S. Bae) [Orabug: 38773165] {CVE-2025-68171}
    - virtio-net: fix received length check in big packets (Bui Quang Minh) [Orabug: 38737152]     {CVE-2025-40292}
    - ACPI: CPPC: Fix NULL pointer dereference when nosmp is used (Yunhui Cui) [Orabug: 38641284]     {CVE-2025-38113}
    - EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller (Qiuxu Zhuo) [Orabug: 38649173]     {CVE-2025-40157}
    - sunrpc: fix null pointer dereference on zero-length checksum (Lei Lu) [Orabug: 38649042]     {CVE-2025-40129}
    - cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() (Jinjie Ruan) [Orabug: 38641275]     {CVE-2024-53230}
    - cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw() (Jinjie Ruan) [Orabug: 38641272]     {CVE-2024-53231}
    - vhost: vringh: Fix copy_to_iter return value check (Michael S. Tsirkin) [Orabug: 38592117]     {CVE-2025-40056}
    - crypto: qat - flush misc workqueue during device shutdown (Giovanni Cabiddu) [Orabug: 38401717]     {CVE-2025-39721}
    - vhost: vringh: Modify the return value check (Zhang Jiao) [Orabug: 38592085] {CVE-2025-40051}
    - virtio-net: fix recursived rtnl_lock() during probe() (Zigit Zo) [Orabug: 38324330] {CVE-2025-38551}
    - gve: prevent ethtool ops after shutdown (Jordan Rhee) [Orabug: 38401492] {CVE-2025-38735}
    - KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight (Sean Christopherson)     [Orabug: 38254140] {CVE-2025-38455}
    - net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (Oleksij Rempel) [Orabug: 38253871]     {CVE-2025-38385}
    - net/mlx5e: Disable MACsec offload for uplink representor profile (Carolina Jubran) [Orabug: 38094809]     {CVE-2025-38020}
    - dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (Shuai Xue) [Orabug: 38094794]     {CVE-2025-38015}
    - net/mlx5: Fix ECVF vports unload on shutdown flow (Amir Tzin) [Orabug: 38152903] {CVE-2025-38109}
    - bnxt: properly flush XDP redirect lists (Yan Zhai) [Orabug: 38175054] {CVE-2025-38246}
    - eth: bnxt: fix missing ring index trim on error path (Jakub Kicinski) [Orabug: 37937451]     {CVE-2025-37873}
    - net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table() (Henry Martin) [Orabug: 37938078]     {CVE-2025-37888}
    - nfsd: fix possible badness in FREE_STATEID (Olga Kornievskaia) [Orabug: 37989102] {CVE-2024-50043}
    - devlink: fix xa_alloc_cyclic() error handling (Michal Swiatkowski) [Orabug: 37828271] {CVE-2025-22017}
    - xsk: fix an integer overflow in xp_create_and_assign_umem() (Gavrilov Ilia) [Orabug: 37828202]     {CVE-2025-21997}
    - RDMA/mlx5: Fix the recovery flow of the UMR QP (Yishai Hadas) [Orabug: 37766306] {CVE-2025-21892}
    - misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors (Vimal Agrawal) [Orabug: 37678552]     {CVE-2024-58078}
    - net/sched: cls_api: fix error handling causing NULL dereference (Pierre Riteau) [Orabug: 37702083]     {CVE-2025-21857}
    - bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (Shigeru Yoshida) [Orabug: 37766220]     {CVE-2025-21867}
    - net: xdp: Disallow attaching device-bound programs in generic mode (Toke Hoiland-Jorgensen) [Orabug:
    37650238] {CVE-2025-21808}
    - iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() (Qasim Ijaz) [Orabug:
    37649891] {CVE-2025-21724}
    - xfrm: delete intermediate secpath entry in packet offload mode (Alexandre Cassen) [Orabug: 37649866]     {CVE-2025-21720}
    - gpiolib: Fix crash on error in gpiochip_get_ngpios() (Andy Shevchenko) [Orabug: 37650154]     {CVE-2025-21783}
    - scsi: mpi3mr: Fix possible crash when setting up bsg fails (Guixin Liu) [Orabug: 37649886]     {CVE-2025-21723}
    - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)     [Orabug: 39151165,39159089] {CVE-2026-23401}
    - scsi: core: Fix refcount leak for tagset_refcnt (Junxiao Bi) [Orabug: 38976650,39130775]     {CVE-2026-23296}
    - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (Jiayuan Chen) [Orabug: 39188477]     {CVE-2026-31411}
    - RDMA/umad: Reject negative data_len in ib_umad_write (Yunje Shin) [Orabug: 39103109] {CVE-2026-23243}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50262 advisory.

    - xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)  [Orabug: 39344527]     {CVE-2026-43284}
    - x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia)  [Orabug: 39344576]  {CVE-2025-54518}
    - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [Orabug: 39250687,39331106]     {CVE-2026-43077}
    - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug:
    39250687,39331111] {CVE-2026-43078}
    - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug:
    39250687,39300911] {CVE-2026-43033}
    - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug: 39250687,39283868,39292250]     {CVE-2026-31431}
    - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250687]     {CVE-2026-31431}
    - x86/CPU: Fix FPDSS on Zen1 (Siddh Raman Pant) [Orabug: 39241225,39273723] {CVE-2026-31628}
    - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (Joshua Rogers)     [Orabug: 38852342] {CVE-2025-71120}
    - net/sched: Enforce that teql can only be used as root qdisc (Jamal Hadi Salim) [Orabug: 38930950]     {CVE-2026-23074}
    - macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887731] {CVE-2026-23001}
    - macvlan: Use 'hash' iterators to simplify code (Christophe Jaillet) [Orabug: 38887731] {CVE-2026-23001}
    - macvlan: Add nodst option to macvlan type source (Jethro Beekman) [Orabug: 38887731] {CVE-2026-23001}
    - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug:
    38970510,39188399] {CVE-2026-23209,CVE-2026-23273}
    - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 38970510]     {CVE-2026-23209}
    - io_uring: fix filename leak in __io_openat_prep() (Prithvi Tambewagh) [Orabug: 39064937]     {CVE-2025-68814}
    - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina     Dubroca) [Orabug: 38934000,39004270] {CVE-2025-40256}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
314355	KB5087539: Windows Server 2025 Security Update (May 2026)	Nessus	Windows : Microsoft Bulletins	high
314353	KB5087544: Windows 10 version 21H2 / Windows 10 Version 22H2 Security Update (May 2026)	Nessus	Windows : Microsoft Bulletins	high
314352	KB5087545: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (May 2026)	Nessus	Windows : Microsoft Bulletins	high
314349	KB5087420: Windows 11 version 23H2 Security Update (May 2026)	Nessus	Windows : Microsoft Bulletins	high
314348	KB5087537: Windows 10 Version 1607 / Windows Server 2016 Security Update (May 2026)	Nessus	Windows : Microsoft Bulletins	high
314347	KB5087541: Windows Server version 23H2 Security Update (May 2026)	Nessus	Windows : Microsoft Bulletins	high
314346	KB5087538: Windows 10 version 1809 / Windows Server 2019 Security Update (May 2026)	Nessus	Windows : Microsoft Bulletins	high
314342	KB5089548: Windows 11 Version 26H1 Security Update (May 2026)	Nessus	Windows : Microsoft Bulletins	high
314341	KB5089549: Windows 11 Version 24H2 / Windows 11 Version 25H2 Security Update (May 2026)	Nessus	Windows : Microsoft Bulletins	high
314333	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50260)	Nessus	Oracle Linux Local Security Checks	high
314332	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50261)	Nessus	Oracle Linux Local Security Checks	high
314331	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2026-50262)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2025-54518

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high