ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file. The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version
    1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path
    by compromising an existing logback configuration file. The instantiation of a potentially malicious Java
    class requires that said class is present on the user's class-path. In addition, the attacker must have
    write access to a configuration file. However, after successful instantiation, the instance is very likely
    to be discarded with no further ado. (CVE-2026-1225)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0361-1 advisory.

    - CVE-2026-1225: ACE vulnerability in configuration file (bsc#1257094)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version     1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path     by compromising an existing logback configuration file. The instantiation of a potentially malicious Java     class requires that said class is present on the user's class-path. In addition, the attacker must have     write access to a configuration file. However, after successful instantiation, the instance is very likely     to be discarded with no further ado. (CVE-2026-1225)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
464959	Echo: ch.qos.logback:logback-core: security update to 1.5.25	Tenable Cloud Security	Echo Local Security Checks	Local	low
464959	Echo: ch.qos.logback:logback-core: security update to 1.5.25	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
297612	openSUSE 15 Security Update : logback (SUSE-SU-2026:0361-1)	Nessus	SuSE Local Security Checks	Local	low
436901	SCA: security update for ch.qos.logback:logback-core (GHSA-qqpg-mvqg-649v)	Tenable Cloud Security	SCA Checks	Local	low
436901	SCA: security update for ch.qos.logback:logback-core (GHSA-qqpg-mvqg-649v)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
295333	Linux Distros Unpatched Vulnerability : CVE-2026-1225	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-1225

low

Tenable Plugins

low

low

low

low

low

low