Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.

oracle CPUJan2026: Business Intelligence Enterprise Edition

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform
    spoofing over a network. (CVE-2025-59250)

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities:

  - Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
    (CVE-2025-59250)

  - Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class     may excessively consume CPU resources when processing maliciously crafted input. (CVE-2024-47554)

  - Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol     servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline     characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per     HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension),     attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks.     (CVE-2025-58056)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The The Microsoft JDBC driver for MSSQL installed on the remote host is missing a security update. It is, therefore, affected by the following vulnerability:

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2025-59250)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
462985	Echo: com.microsoft.sqlserver:mssql-jdbc: security update to 10.2.4.jre11	Tenable Cloud Security	Echo Local Security Checks	Local	high
462985	Echo: com.microsoft.sqlserver:mssql-jdbc: security update to 10.2.4.jre11	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
294984	Oracle GoldenGate for Big Data Multiple Vulnerabilities 21.x < 21.21.0.0.0 (January 2026 CPU)	Nessus	Misc.	Local	medium
278728	Security Updates for Microsoft JDBC driver for MSSQL (October 2025)	Nessus	Windows : Microsoft Bulletins	Local	high
435911	SCA: security update for com.microsoft.sqlserver:mssql-jdbc (GHSA-m494-w24q-6f7w)	Tenable Cloud Security	SCA Checks	Local	high
435911	SCA: security update for com.microsoft.sqlserver:mssql-jdbc (GHSA-m494-w24q-6f7w)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2025-59250

high

Tenable Plugins

Coming Soon

high

high

medium

high

high

high