The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true. This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions: * The attacker is able to intercept or redirect network traffic between the client and the log receiver. * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured). Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue. As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.

oracle CPUApr2026: Business Intelligence Enterprise Edition

oracle CPUApr2026: Enterprise Manager Base Platform

oracle CPUApr2026: Oracle E-Business Suite

oracle CPUJan2026: Business Intelligence Enterprise Edition

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory.

  - Security-in-Depth issue in the Spatial and Graph (SQLite) component of Oracle Database Server. This     vulnerability cannot be exploited in the context of this product. (CVE-2025-6965)

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are     19.3-19.30 and 21.3-21.21. Easily exploitable vulnerability allows unauthenticated attacker with network     access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Java VM accessible data. (CVE-2026-35229)

  - Vulnerability in the Clusterware (Micronaut) component of Oracle Database Server. Supported versions that     are affected are 19.3-19.30 and 23.4.0-23.26.1. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Clusterware (Micronaut). Successful attacks of this     vulnerability can result in unauthorized creation, deletion or modification access to critical data or all     Clusterware (Micronaut) accessible data. (CVE-2026-33013, CVE-2026-33870)

  - Vulnerability in the RDBMS (OpenSSL) component of Oracle Database Server. Supported versions that are     affected are 19.3-19.30 and 23.4.0-23.26.1. Easily exploitable vulnerability allows high privileged     attacker having None privilege with network access via multiple protocols to compromise RDBMS (OpenSSL).
    Successful attacks of this vulnerability can result in takeover of RDBMS (OpenSSL). (CVE-2026-31790)

  - Vulnerability in the RDBMS (Python) component of Oracle Database Server. Supported versions that are     affected are 21.3-21.21 and 23.4.0-23.26.1. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise RDBMS (Python). Successful attacks     require human interaction from a person other than the attacker. Successful attacks of this vulnerability     can result in unauthorized access to critical data or complete access to all RDBMS (Python) accessible     data. (CVE-2026-26007)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Process Management Suite installed on the remote host is affected by multiple vulnerabilities, as referenced in the April 2026 CPU advisory:

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Composer (Apache Avro)). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access to some of Oracle Business Process Management     Suite accessible data as well as unauthorized read access to a subset of Oracle Business Process     Management Suite accessible data and unauthorized ability to cause a partial denial of service     (partial DOS) of Oracle Business Process Management Suite. (CVE-2025-33042)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Runtime Engine (Apache Log4j)). Supported versions that are affected are 12.2.1.4.0 and     14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via     TLS to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access to some of Oracle Business Process Management     Suite accessible data as well as unauthorized read access to a subset of Oracle Business Process     Management Suite accessible data. (CVE-2025-68161)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Human workflow 11g+). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Business Process Management Suite. Successful attacks require human interaction from a     person other than the attacker and while the vulnerability is in Oracle Business Process Management Suite,     attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability     can result in unauthorized update, insert or delete access to some of Oracle Business Process Management     Suite accessible data as well as unauthorized read access to a subset of Oracle Business Process Management     Suite accessible data. (CVE-2026-34284)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 7.6.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory.

  - mchange-commons-java, a library that provides Java utilities, includes code that mirrors early     implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by     which code can be downloaded and invoked within a running application. If an attacker can provoke an     application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke     the download and execution of malicious code. Implementations of this functionality within the JDK were     disabled by default behind a System property that defaults to `false`,     `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent     implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that     implementation could be provoked to download and execute malicious code even after the JDK was hardened.
    Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters     that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions     prior to 0.4.0 should be avoided on application CLASSPATHs. (CVE-2026-27727)

  - Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure     vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system     temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all     other users locally on the system. As such, if the contents written is security sensitive, it can be     disclosed to other local users. (CVE-2021-28168)

  - In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource     consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter     (PBKDF2) component. (CVE-2023-52428)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 8.2.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory.

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Platform Security (Eclipse Jersey)). Supported versions that are affected are 7.6.0.0.0 and     8.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the     infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle     Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise     Edition accessible data. (CVE-2021-28168)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Platform Security (Mchange Commons Java)). Supported versions that are affected are 7.6.0.0.0     and 8.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     LDAP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2026-27727)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: BI Platform Security (OpenSSL)). The supported version that is affected is 8.2.0.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle     Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business     Intelligence Enterprise Edition. (CVE-2025-15467)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 14.1.2.1.0 version of Identity Manager installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory:

  - Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Identity     Console). Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Identity Manager. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Oracle Identity Manager, attacks may significantly     impact additional products (scope change). Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle Identity Manager accessible data as well     as unauthorized read access to a subset of Oracle Identity Manager accessible data. (CVE-2026-34283)

  - The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname     verification of the peer certificate, even when the verifyHostName configuration attribute or the     log4j2.sslVerifyHostName system property is set to true. This issue may allow a man-in-the-middle     attacker to intercept or redirect log traffic under the following conditions: * The attacker is able to     intercept or redirect network traffic between the client and the log receiver. * The attacker can present     a server certificate issued by a certification authority trusted by the Socket Appender's configured trust     store (or by the default Java trust store if no custom trust store is configured). Users are advised to     upgrade to Apache Log4j Core version 2.25.3, which addresses this issue. As an alternative mitigation,     the Socket Appender may be configured to use a private or restricted trust root to limit the set of     trusted certificates. (CVE-2025-68161)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 version of Identity Manager installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory:

  - In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a     gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of     data between requests. (CVE-2024-13009)

  - Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Identity     Console). Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Identity Manager. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Oracle Identity Manager, attacks may significantly     impact additional products (scope change). Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle Identity Manager accessible data as well     as unauthorized read access to a subset of Oracle Identity Manager accessible data. (CVE-2026-34283)

  - The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname     verification of the peer certificate, even when the verifyHostName configuration attribute or the     log4j2.sslVerifyHostName system property is set to true. This issue may allow a man-in-the-middle     attacker to intercept or redirect log traffic under the following conditions: * The attacker is able to     intercept or redirect network traffic between the client and the log receiver. * The attacker can present     a server certificate issued by a certification authority trusted by the Socket Appender's configured trust     store (or by the default Java trust store if no custom trust store is configured). Users are advised to     upgrade to Apache Log4j Core version 2.25.3, which addresses this issue. As an alternative mitigation,     the Socket Appender may be configured to use a private or restricted trust root to limit the set of     trusted certificates. (CVE-2025-68161)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Unifier installed on the remote host are affected by a vulnerability as referenced in the April 2026 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Apache Log4j)). Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15,     23.12.0-23.12.16, 24.12.0-24.12.13 and 25.12.0-25.12.3. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via TLS to compromise Primavera Unifier. Successful attacks     of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera     Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible     data. (CVE-2025-68161)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 and 14.1.2.0.0 versions of WebCenter Sites installed on the remote host are affected by a vulnerability as referenced in the April 2026 CPU advisory.

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Thick Client     (Apache Log4j)). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle WebCenter     Sites. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access     to some of Oracle WebCenter Sites accessible data as well as unauthorized read access to a subset of     Oracle WebCenter Sites accessible data. (CVE-2025-68161)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory.

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST (Jettison)).
    Supported versions that are affected are 17.0-26.2. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Siebel CRM Integration. (CVE-2022-40149, CVE-2022-40150, CVE-2022-45685,     CVE-2022-45693, CVE-2023-1436, CVE-2026-28493, CVE-2026-28494, CVE-2026-28686, CVE-2026-28687,     CVE-2026-28688, CVE-2026-28689, CVE-2026-28690, CVE-2026-28691, CVE-2026-28692, CVE-2026-28693,     CVE-2026-30883, CVE-2026-30929, CVE-2026-30931, CVE-2026-30935, CVE-2026-30936)

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Keyword Automation     (Netty)). Supported versions that are affected are 17.0-26.2. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Siebel CRM Deployment. (CVE-2025-58056, CVE-2025-58057)

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Event Publish and     Subscribe (Apache Kafka)). Supported versions that are affected are 17.0-26.2. Easily exploitable     vulnerability allows unauthenticated attacker with network access via TCP to compromise Siebel CRM     Integration. Successful attacks of this vulnerability can result in unauthorized access to critical data     or complete access to all Siebel CRM Integration accessible data. (CVE-2025-27817, CVE-2025-27818)

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Event Publish and     Subscribe (jose4j)). Supported versions that are affected are 17.0-26.2. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Siebel CRM Integration. (CVE-2023-51775, CVE-2024-29371)

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Keyword Automation     (Apache Commons Lang)). Supported versions that are affected are 17.0-26.2. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM     Deployment. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial     denial of service (partial DOS) of Siebel CRM Deployment. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services).
    Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Oracle WebLogic Server accessible data. (CVE-2026-34305)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services).
    Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebLogic Server. Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all Oracle WebLogic Server accessible data. (CVE-2026-34315)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Third Party Jars (Apache Log4j)). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0,     14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network     access via TLS to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result     in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well     as unauthorized read access to a subset of Oracle WebLogic Server accessible data. (CVE-2025-68161)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.5.1 advisory.

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in     the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The     identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended     to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in     Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from     2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the     issue. (CVE-2025-48976)

  - The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing     hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled     SSRF if a URL is processed by more than one URL parser. (CVE-2024-11168)

  - CPython 3.9 and earlier doesn't disallow configuring an empty list ([]) for     SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a     buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity     due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically     a protocol name would be configured). (CVE-2024-5642)

  - A vulnerability has been found in the CPython `venv` module and CLI where path names provided when     creating a virtual environment were not quoted properly, allowing the creator to inject commands into     virtual environment activation scripts (ie source venv/bin/activate). This means that attacker-     controlled virtual environments are able to run commands when the virtual environment is activated.
    Virtual environments which are not created by an attacker or which aren't activated before being used (ie     ./venv/bin/python) are not affected. (CVE-2024-9287)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.0.1.14. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.0.1.14 advisory.

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in     the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The     identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended     to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read     vulnerability exists in png_image_read_composite when processing palette images with     PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly     applies background compositing during premultiplication, violating the invariant component  alpha  257     required by the simplified PNG API. This issue has been patched in version 1.6.51. (CVE-2025-64720)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow     vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit     interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond     allocated buffer bounds. This issue has been patched in version 1.6.51. (CVE-2025-65018)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471,     8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9;
    Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE,     Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. (CVE-2026-21925)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471,     8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9;
    Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than     the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition, attacks may significantly impact additional products (scope change). Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle     Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized     read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g.,     through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2026-21933)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.3.1.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.3.1.5 advisory.

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in     the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The     identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended     to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read     vulnerability exists in png_image_read_composite when processing palette images with     PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly     applies background compositing during premultiplication, violating the invariant component  alpha  257     required by the simplified PNG API. This issue has been patched in version 1.6.51. (CVE-2025-64720)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow     vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit     interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond     allocated buffer bounds. This issue has been patched in version 1.6.51. (CVE-2025-65018)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471,     8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9;
    Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE,     Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. (CVE-2026-21925)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471,     8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9;
    Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than     the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition, attacks may significantly impact additional products (scope change). Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle     Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized     read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g.,     through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2026-21933)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.5.0.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.5.0.6 advisory.

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in     the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The     identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended     to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing     hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled     SSRF if a URL is processed by more than one URL parser. (CVE-2024-11168)

  - CPython 3.9 and earlier doesn't disallow configuring an empty list ([]) for     SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a     buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity     due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically     a protocol name would be configured). (CVE-2024-5642)

  - A vulnerability has been found in the CPython `venv` module and CLI where path names provided when     creating a virtual environment were not quoted properly, allowing the creator to inject commands into     virtual environment activation scripts (ie source venv/bin/activate). This means that attacker-     controlled virtual environments are able to run commands when the virtual environment is activated.
    Virtual environments which are not created by an attacker or which aren't activated before being used (ie     ./venv/bin/python) are not affected. (CVE-2024-9287)

  - The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that     included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be     used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential     parsing across the Python URL parser and other specification-compliant URL parsers. (CVE-2025-0938)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1398 advisory.

    The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname     verification of the peer certificate, even when the  verifyHostName     https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName     configuration attribute or the  log4j2.sslVerifyHostName     https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system     property is set to true.

    This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following     conditions:

    *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.*     The attacker can present a server certificate issued by a certification authority trusted by the Socket     Appender's configured trust store (or by the default Java trust store if no custom trust store is     configured).

    Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.

    As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust     root to limit the set of trusted certificates. (CVE-2025-68161)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20099-1 advisory.

    Changes in coredns:

    - fix CVE-2025-68156 bsc#1255345
    - fix CVE-2025-68161 bsc#1256411
    - Update to version 1.14.0:
      * core: Fix gosec G115 integer overflow warnings
      * core: Add regex length limit
      * plugin/azure: Fix slice init length
      * plugin/errors: Add optional show_first flag to consolidate directive
      * plugin/file: Fix for misleading SOA parser warnings
      * plugin/kubernetes: Rate limits to api server
      * plugin/metrics: Implement plugin chain tracking
      * plugin/sign: Report parser err before missing SOA
      * build(deps): bump github.com/expr-lang/expr from 1.17.6 to 1.17.7

    - Update to version 1.13.2:
      * core: Add basic support for DoH3
      * core: Avoid proxy unnecessary alloc in Yield
      * core: Fix usage of sync.Pool to save an alloc
      * core: Fix data race with sync.RWMutex for uniq
      * core: Prevent QUIC reload panic by lazily initializing the listener
      * core: Refactor/use reflect.TypeFor
      * plugin/auto: Limit regex length
      * plugin/cache: Remove superfluous allocations in item.toMsg
      * plugin/cache: Isolate metadata in prefetch goroutine
      * plugin/cache: Correct spelling of MaximumDefaultTTL in cache and dnsutil         packages
      * plugin/dnstap: Better error handling (redial & logging) when Dnstap is busy
      * plugin/file: Performance finetuning
      * plugin/forward: Disallow NOERROR in failover
      * plugin/forward: Added support for per-nameserver TLS SNI
      * plugin/forward: Prevent busy loop on connection err
      * plugin/forward: Add max connect attempts knob
      * plugin/geoip: Add ASN schema support
      * plugin/geoip: Add support for subdivisions
      * plugin/kubernetes: Fix kubernetes plugin logging
      * plugin/multisocket: Cap num sockets to prevent OOM
      * plugin/nomad: Support service filtering
      * plugin/rewrite: Pre-compile CNAME rewrite regexp
      * plugin/secondary: Fix reload causing secondary plugin goroutine to leak

    - Update to version 1.13.1:
      * core: Avoid string concatenation in loops
      * core: Update golang to 1.25.2 and golang.org/x/net to v0.45.0 on CVE fixes
      * plugin/sign: Reject invalid UTF8 dbfile token

    - Update to version 1.13.0:
      * core: Export timeout values in dnsserver.Server
      * core: Fix Corefile infinite loop on unclosed braces
      * core: Fix Corefile related import cycle issue
      * core: Normalize panics on invalid origins
      * core: Rely on dns.Server.ShutdownContext to gracefully stop
      * plugin/dnstap: Add bounds for plugin args
      * plugin/file: Fix data race in tree Elem.Name
      * plugin/forward: No failover to next upstream when receiving SERVFAIL or         REFUSED response codes
      * plugin/grpc: Enforce DNS message size limits
      * plugin/loop: Prevent panic when ListenHosts is empty
      * plugin/loop: Avoid panic on invalid server block
      * plugin/nomad: Add a Nomad plugin
      * plugin/reload: Prevent SIGTERM/reload deadlock

    - fix CVE-2025-58063 bsc#1249389
    - Update to version 1.12.4:
      * bump deps
      * fix(transfer): goroutine leak on axfr err (#7516)
      * plugin/etcd: fix import order for ttl test (#7515)
      * fix(grpc): check proxy list length in policies (#7512)
      * fix(https): propagate HTTP request context (#7491)
      * fix(plugin): guard nil lookups across plugins (#7494)
      * lint: add missing prealloc to backend lookup test (#7510)
      * fix(grpc): span leak on error attempt (#7487)
      * test(plugin): improve backend lookup coverage (#7496)
      * lint: enable prealloc (#7493)
      * lint: enable durationcheck (#7492)
      * Add Sophotech to adopters list (#7495)
      * plugin: Use %w to wrap user error (#7489)
      * fix(metrics): add timeouts to metrics HTTP server (#7469)
      * chore(ci): restrict token permissions (#7470)
      * chore(ci): pin workflow dependencies (#7471)
      * fix(forward): use netip package for parsing (#7472)
      * test(plugin): improve test coverage for pprof (#7473)
      * build(deps): bump github.com/go-viper/mapstructure/v2 (#7468)
      * plugin/file: fix label offset problem in ClosestEncloser (#7465)
      * feat(trace): migrate dd-trace-go v1 to v2 (#7466)
      * test(multisocket): deflake restart by using a fresh port and coordinated cleanup (#7438)
      * chore: update Go version to 1.24.6 (#7437)
      * plugin/header: Remove deprecated syntax (#7436)
      * plugin/loadbalance: support prefer option (#7433)
      * Improve caddy.GracefulServer conformance checks (#7416)

    - Update to version 1.12.3:
      * chore: Minor changes to `Dockerfile` (#7428)
      * Properly create hostname from IPv6 (#7431)
      * Bump deps
      * fix: handle cached connection closure in forward plugin (#7427)
      * plugin/test: fix TXT record comparison for multi-chunk vs multiple records
      * plugin/file: preserve case in SRV record names and targets per RFC 6763
      * fix(auto/file): return REFUSED when no next plugin is available (#7381)
      * Port to AWS Go SDK v2 (#6588)
      * fix(cache): data race when refreshing cached messages (#7398)
      * fix(cache): data race when updating the TTL of cached messages (#7397)
      * chore: fix docs incompatibility (#7390)
      * plugin/rewrite: Add EDNS0 Unset Action (#7380)
      * add args: startup_timeout for kubernetes plugin (#7068)
      * [plugin/cache] create a copy of a response to ensure original data is never          modified
      * Add support for fallthrough to the grpc plugin (#7359)
      * view: Add IPv6 example match (#7355)
      * chore: enable more rules from revive (#7352)
      * chore: enable early-return and superfluous-else from revive (#7129)
      * test(plugin): improve tests for auto (#7348)
      * fix(proxy): flaky dial tests (#7349)
      * test: add t.Helper() calls to test helper functions (#7351)
      * fix(kubernetes): multicluster DNS race condition (#7350)
      * lint: enable wastedassign linter (#7340)
      * test(plugin): add tests for any (#7341)
      * Actually invoke make release -f Makefile.release during test (#7338)
      * Keep golang to 1.24.2 due to build issues in 1.24.3 (#7337)
      * lint: enable protogetter linter (#7336)
      * lint: enable nolintlint linter (#7332)
      * fix: missing intrange lint fix (#7333)
      * perf(kubernetes): optimize AutoPath slice allocation (#7323)
      * lint: enable intrange linter (#7331)
      * feat(plugin/file): fallthrough (#7327)
      * lint: enable canonicalheader linter (#7330)
      * fix(proxy): avoid Dial hang after Transport stopped (#7321)
      * test(plugin): add tests for pkg/rand (#7320)
      * test(dnsserver): add unit tests for gRPC and QUIC servers (#7319)
      * fix: loop variable capture and linter (#7328)
      * lint: enable usetesting linter (#7322)
      * test: skip certain network-specific tests on non-Linux (#7318)
      * test(dnsserver): improve core/dnsserver test coverage (#7317)
      * fix(metrics): preserve request size from plugins (#7313)
      * fix: ensure DNS query name reset in plugin.NS error path (#7142)
      * feat: enable plugins via environment during build (#7310)
      * fix(plugin/bind): remove zone for link-local IPv4 (#7295)
      * test(request): improve coverage across package (#7307)
      * test(coremain): Add unit tests (#7308)
      * ci(test-e2e): add Go version setup to workflow (#7309)
      * kubernetes: add multicluster support (#7266)
      * chore: Add new maintainer thevilledev (#7298)
      * Update golangci-lint (#7294)
      * feat: limit concurrent DoQ streams and goroutines (#7296)
      * docs: add man page for multisocket plugin (#7297)
      * Prepare for the k8s api upgrade (#7293)
      * fix(rewrite): truncated upstream response (#7277)
      * fix(plugin/secondary): make transfer property mandatory (#7249)
      * plugin/bind: remove macOS bug mention in docs (#7250)
      * Remove `?bla=foo:443` for `POST` DoH (#7257)
      * Do not interrupt querying readiness probes for plugins (#6975)
      * Added `SetProxyOptions` function for `forward` plugin (#7229)

    -  Backported quic-go PR #5094: Fix parsing of ifindex from packets        to ensure compatibility with big-endian architectures        (see quic-go/quic-go#4978, coredns/coredns#6682).

    - Update to version 1.12.1:
      * core: Increase CNAME lookup limit from 7 to 10 (#7153)
      * plugin/kubernetes: Fix handling of pods having DeletionTimestamp set
      * plugin/kubernetes: Revert only create PTR records for endpoints with         hostname defined
      * plugin/forward: added option failfast_all_unhealthy_upstreams to return         servfail if all upstreams are down
      * bump dependencies, fixing bsc#1239294 and bsc#1239728

    - Update to version 1.12.0:
      * New multisocket plugin - allows CoreDNS to listen on multiple sockets
      * bump deps

    - Update to version 1.11.4:
      * forward plugin: new option next, to try alternate upstreams when receiving         specified response codes upstreams on (functions like the external plugin         alternate)
      * dnssec plugin: new option to load keys from AWS Secrets Manager
      * rewrite plugin: new option to revert EDNS0 option rewrites in responses

    - Update to version 1.11.3+git129.387f34d:
      * fix CVE-2024-51744 (https://bugzilla.suse.com/show_bug.cgi?id=1232991)         build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#6955)
      * core: set cache-control max-age as integer, not float (#6764)
      * Issue-6671: Fixed the order of plugins. (#6729)
      * `root`: explicit mark `dnssec` support (#6753)
      * feat: dnssec load keys from AWS Secrets Manager (#6618)
      * fuzzing: fix broken oss-fuzz build (#6880)
      * Replace k8s.io/utils/strings/slices by Go stdlib slices (#6863)
      * Update .go-version to 1.23.2 (#6920)
      * plugin/rewrite: Add revert parameter for EDNS0 options (#6893)
      * Added OpenSSF Scorecard Badge (#6738)
      * fix(cwd): Restored backwards compatibility of Current Workdir (#6731)
      * fix: plugin/auto: call OnShutdown() for each zone at its own OnShutdown() (#6705)
      * feature: log queue and buffer memory size configuration (#6591)
      * plugin/bind: add zone for link-local IPv6 instead of skipping (#6547)
      * only create PTR records for endpoints with hostname defined (#6898)
      * fix: reverter should execute the reversion in reversed order (#6872)
      * plugin/etcd: fix etcd connection leakage when reload (#6646)
      * kubernetes: Add useragent (#6484)
      * Update build (#6836)
      * Update grpc library use (#6826)
      * Bump go version from 1.21.11 to 1.21.12 (#6800)
      * Upgrade antonmedv/expr to expr-lang/expr (#6814)
      * hosts: add hostsfile as label for coredns_hosts_entries (#6801)
      * fix TestCorefile1 panic for nil handling (#6802)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0254-1 advisory.

    Security fixes:

    - CVE-2025-68161: Fixed absent TLS hostname verification           that may allow a man-in-the-middle attack (bsc#1255427)

    Other fixes:

    - Upgrade to 2.18.0
      * Added
        - Add support for Jakarta Mail API in the SMTP appender.
        - Add support for custom Log4j 1.x levels.
        - Add support for adding and retrieving appenders in Log4j 1.x           bridge.
        - Add support for custom LMAX disruptor WaitStrategy           configuration.
        - Add support for Apache Extras' RollingFileAppender in Log4j           1.x bridge.
        - Add MutableThreadContextMapFilter.
        - Add support for 24 colors in highlighting
      * Changed
        - Improves ServiceLoader support on servlet containers.
        - Make the default disruptor WaitStrategy used by Async Loggers           garbage-free.
        - Do not throw UnsupportedOperationException when JUL           ApiLogger::setLevel is called.
        - Support Spring 2.6.x.
        - Move perf tests to log4j-core-its
        - Upgrade the Flume Appender to Flume 1.10.0
      * Fixed
        - Fix minor typo #792.
        - Improve validation and reporting of configuration errors.
        - Allow enterprise id to be an OID fragment.
        - Fix problem with non-uppercase custom levels.
        - Avoid ClassCastException in JeroMqManager with custom           LoggerContextFactory #791.
        - DirectWriteRolloverStrategy should use the current time when           creating files.
        - Fixes the syslog appender in Log4j 1.x bridge, when used with           a custom layout.
        - log4j-1.2-api 2.17.2 throws NullPointerException while           removing appender with name as null.
        - Improve JsonTemplateLayout performance.
        - Fix resolution of non-Log4j properties.
        - Fixes Spring Boot logging system registration in a           multi-application environment.
        + JAR file containing Log4j configuration isnt closed.
        + Properties defined in configuration using a value attribute           (as opposed to element) are read correctly.
        + Syslog appender lacks the SocketOptions setting.
        + Log4j 1.2 bridge should not wrap components unnecessarily.
        + Update 3rd party dependencies for 2.18.0.
        + SizeBasedTriggeringPolicy would fail to rename files properly           when integer pattern contained a leading zero.
        + Fixes default SslConfiguration, when a custom keystore is           used.
        + Fixes appender concurrency problems in Log4j 1.x bridge.
        + Fix and test for race condition in FileUtils.mkdir().
        + LocalizedMessage logs misleading errors on the console.
        + Add missing message parameterization in RegexFilter.
        + Add the missing context stack to JsonLayout template.
        + HttpWatcher did not pass credentials when polling.
        + UrlConnectionFactory.createConnection now accepts an           AuthorizationProvider as a parameter.
        + The DirectWriteRolloverStrategy was not detecting the correct           index to use during startup.
        + Async Loggers were including the location information by           default.
        + ClassArbiters newBuilder method referenced the wrong class.
        + Dont use Paths.get() to avoid circular file systems.
        + Fix parsing error, when XInclude is disabled.
        + Fix LevelRangeFilterBuilder to align with log4j1s behavior.
        + Fixes problem with wrong ANSI escape code for bright colors         + Log4j 1.2 bridge should generate Log4j 2.x messages based on           the parameter runtime type.
    - Update to 2.19.0
      * Added         + Add implementation of SLF4J2 fluent API.
        + Add support for SLF4J2 stack-valued MDC.
      * Changed         + Add getExplicitLevel method to LoggerConfig.
        + Allow PropertySources to be added.
        + Allow Plugins to be injected with the LoggerContext reference.
      * Fixed         + Add correct manifest entries for OSGi to log4j-jcl         + Improve support for passwordless keystores.
        + SystemPropertyArbiter was assigning the value as the name.
        + Make JsonTemplateLayout stack trace truncation operate for           each label block.
        + Fix recursion between Log4j 1.2 LogManager and Category.
        + Fix resolution of properties not starting with log4j2..
        + Logger$PrivateConfig.filter(Level, Marker, String) was           allocating empty varargs array.
        + Allows a space separated list of style specifiers in the           %style pattern for consistency with %highlight.
        + Fix NPE in log4j-to-jul in the case the root logger level is           null.
        + Fix RollingRandomAccessFileAppender with           DirectWriteRolloverStrategy cant create the first log file of           different directory.
        + Generate new SSL certs for testing.
        + Fix ServiceLoaderUtil behavior in the presence of a           SecurityManager.
        + Fix regression in Rfc5424Layout default values.
        + Harden InstantFormatter against delegate failures.
        + Add async support to Log4jServletFilter.
      * Removed         + Removed build page in favor of a single build instructions           file.
        + Remove SLF4J 1.8.x binding.
    - Update to 2.20.0
      * Added         + Add support for timezones in RollingFileAppender date pattern         + Add LogEvent timestamp to ProducerRecord in KafkaAppender         + Add PatternLayout support for abbreviating the name of all           logger components except the 2 rightmost         + Removes internal field that leaked into public API.
        + Add a LogBuilder#logAndGet() method to emulate the           Logger#traceEntry method.
      * Changed         + Simplify site generation         + Switch the issue tracker from JIRA to GitHub Issues         + Remove liquibase-log4j2 maven module         + Fix order of stacktrace elements, that causes cache misses in           ThrowableProxyHelper.
        + Switch from com.sun.mail to Eclipse Angus.
        + Add Log4j2 Core as default runtime dependency of the           SLF4J2-to-Log4j2 API bridge.
        + Replace maven-changes-plugin with a custom changelog           implementation         + Moved log4j-api and log4j-core artifacts with classifier tests           to log4j-api-test and log4j-core-test respectively.
      * Deprecated         + Deprecate support for package scanning for plugins
      * Fixed         + Copy programmatically supplied location even if           includeLocation='false'.
        + Eliminate status logger warning, when disableAnsi or           noConsoleNoAnsi is used the style and highlight patterns.
        + Fix detection of location requirements in RewriteAppender.
        + Replace regex with manual code to escape characters in           Rfc5424Layout.
        + Fix java.sql.Time object formatting in MapMessage         + Fix previous fire time computation in CronTriggeringPolicy         + Correct default to not include location for AsyncRootLoggers         + Make StatusConsoleListener use SimpleLogger internally.
        + Lazily evaluate the level of a SLF4J LogEventBuilder         + Fixes priority of Legacy system properties, which are now back           to having higher priority than Environment variables.
        + Protects ServiceLoaderUtil from unchecked ServiceLoader           exceptions.
        + Fix Configurator#setLevel for internal classes         + Fix level propagation in Log4jBridgeHandler         + Disable OsgiServiceLocator if not running in OSGI container.
        + When using a Date Lookup in the file pattern the current time           should be used.
        + Fixed LogBuilder filtering in the presence of global filters.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Apache Log4j)). Supported versions that are affected are 21.12.0-21.12.16. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via TLS to compromise Primavera Gateway.
    While the vulnerability is in Primavera Gateway, attacks may significantly impact additional products     (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Primavera Gateway accessible data as well as unauthorized read access to a subset     of Primavera Gateway accessible data. (CVE-2025-68161)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Spring Framework)). Supported versions that are affected are 21.12.0-21.12.16. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera     Gateway. Successful attacks of this vulnerability can result in unauthorized access to critical data or     complete access to all Primavera Gateway accessible data. (CVE-2025-41249)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities:

  - The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification     of the peer certificate, even when the verifyHostName configuration attribute or the log4j2.sslVerifyHostName system     property is set to true. (CVE-2025-68161)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4444 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4444-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     January 19, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : apache-log4j2     Version        : 2.17.1-1~deb11u2     CVE ID         : CVE-2025-68161     Debian Bug     : 1123744

    In Apache Log4j2, a Java Logging Framework, the Socket Appender does not     perform TLS hostname verification of the peer certificate, even when the     verifyHostName configuration attribute or the log4j2.sslVerifyHostName     systemproperty is set to true. This issue may allow a man-in-the-middle     attacker to intercept or redirect log traffic under specific and hard to     exploit conditions.

    For Debian 11 bullseye, this problem has been fixed in version     2.17.1-1~deb11u2.

    We recommend that you upgrade your apache-log4j2 packages.

    For the detailed security status of apache-log4j2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/apache-log4j2

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Log4j on the remote host is 2.0-beta9 through 2.25.2. The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true. This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:

  - The attacker is able to intercept or redirect network traffic between the client and the log receiver.
 
  - The attacker can present a server certificate issued by a certification authority trusted by the Socket     Appender’s configured trust store (or by the default Java trust store if no custom trust store is     configured).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname     verification of the peer certificate, even when the verifyHostName     https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName     configuration attribute or the log4j2.sslVerifyHostName     https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property     is set to true. This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic     under the following conditions: * The attacker is able to intercept or redirect network traffic between     the client and the log receiver. * The attacker can present a server certificate issued by a certification     authority trusted by the Socket Appender's configured trust store (or by the default Java trust store if     no custom trust store is configured). Users are advised to upgrade to Apache Log4j Core version 2.25.3,     which addresses this issue. As an alternative mitigation, the Socket Appender may be configured to use a     private or restricted trust root to limit the set of trusted certificates. (CVE-2025-68161)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310136	Oracle Database Server (April 2026 CPU)	Nessus	Databases	high
310114	Oracle Business Process Management Suite (12.2.1.4.0 / 14.1.2.0.0) (April 2026 CPU)	Nessus	Misc.	medium
309965	Oracle Business Intelligence Enterprise Edition (OAS 7.6) (April 2026 CPU)	Nessus	Misc.	high
309964	Oracle Business Intelligence Enterprise Edition (OAS 8.2) (April 2026 CPU)	Nessus	Misc.	high
309961	Oracle Identity Manager (April 2026 CPU)	Nessus	Misc.	medium
309960	Oracle Identity Manager (April 2026 CPU)	Nessus	Misc.	medium
309925	Oracle Primavera Unifier (April 2026 CPU)	Nessus	CGI abuses	medium
309924	Oracle WebCenter Sites (April 2026 CPU)	Nessus	Windows	medium
309923	Oracle Siebel Server <= 26.2 (April 2026 CPU)	Nessus	Misc.	high
309919	Oracle WebLogic Server (April 2026 CPU)	Nessus	Misc.	medium
305057	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.5.1)	Nessus	Misc.	medium
300502	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.0.1.14)	Nessus	Misc.	medium
299799	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.3.1.5)	Nessus	Misc.	medium
299670	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.5.0.6)	Nessus	Misc.	medium
299535	Amazon Linux 2023 : log4j, log4j-jcl, log4j-slf4j (ALAS2023-2026-1398)	Nessus	Amazon Linux Local Security Checks	medium
296576	openSUSE 16 Security Update : coredns (openSUSE-SU-2026:20099-1)	Nessus	SuSE Local Security Checks	medium
296436	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : log4j (SUSE-SU-2026:0254-1)	Nessus	SuSE Local Security Checks	medium
296366	Oracle Primavera Gateway (January 2026 CPU)	Nessus	CGI abuses	medium
294987	Oracle GoldenGate for Big Data MiTM Vulnerability 19.x < 19.1.0.0.22 (January 2026 CPU)	Nessus	Misc.	medium
293760	Debian dla-4444 : liblog4j2-java - security update	Nessus	Debian Local Security Checks	medium
282519	Apache Log4j 2.0-beta9 < 2.25.3 MitM	Nessus	Misc.	medium
279430	Linux Distros Unpatched Vulnerability : CVE-2025-68161	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-68161

medium

Tenable Plugins

Coming Soon

high

medium

high

high

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium