Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20672-1 advisory.

    Update to upstream tag jdk-25.0.3+9 (April 2026 CPU).

    Security issues fixed:

    - CVE-2026-22007: Security: unauthenticated attacker with logon to the infrastructure where java executes     can gain       unauthorized read access to a subset of accessible data (bsc#1262490).
    - CVE-2026-22008: Libraries: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       update, insert or delete access to data (bsc#1262493).
    - CVE-2026-22013: JGSS: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       access to critical data (bsc#1262494).
    - CVE-2026-22016: JAXP: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       to access critical data (bsc#1262495).
    - CVE-2026-22018: Libraries: unauthenticated attacker with network access via multiple protocols can cause     a partial       denial of service (bsc#1262496).
    - CVE-2026-22021: JSSE: unauthenticated attacker with network access via HTTPS can cause a partial denial     of service       (bsc#1262497).
    - CVE-2026-23865: freetype2: integer overflow in the `tt_var_load_item_variation_store` function allows     for an       out-of-bounds read when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts(bsc#1259118).
    - CVE-2026-34268: Security: unauthenticated attacker with logon to the infrastructure where java executes     can gain       unauthorized read access to a subset of data (bsc#1262500).
    - CVE-2026-34282: Networking: unauthenticated attacker with network access via multiple protocols can     cause a hang or       frequently repeatable crash (bsc#1262501).

    Other updates and bugfixes:

    - Provide the timezone-java and tzdata-java (jsc#PED-15898).
    - Migrate to the new logic of FIPS patch developed by RedHat in https://github.com/rh-     openjdk/jdk/tree/fips-25u.
    - Add the sources of /nss-native-fips-key-import-export-adapter.
      * This native library is an adapter for OpenJDK to use the NSS PKCS #11 software token (libsoftokn3.so)     in FIPS mode.
    - Allow overriding of gcc name.
    - Don't make missing system crypto-policies fatal.
    - Add create-crypto-properties-files.bash that generates during the build the config files for different     fips and       non-fips scenarios.
    - Add TestSecurityProperties.java to test the loading of system security properties where applicable.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1704-1 advisory.

    Update to upstream tag jdk-25.0.3+9 (April 2026 CPU).

    Security issues fixed:

    - CVE-2026-22007: Security: unauthenticated attacker with logon to the infrastructure where java executes     can gain       unauthorized read access to a subset of accessible data (bsc#1262490).
    - CVE-2026-22008: Libraries: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       update, insert or delete access to data (bsc#1262493).
    - CVE-2026-22013: JGSS: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       access to critical data (bsc#1262494).
    - CVE-2026-22016: JAXP: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       to access critical data (bsc#1262495).
    - CVE-2026-22018: Libraries: unauthenticated attacker with network access via multiple protocols can cause     a partial       denial of service (bsc#1262496).
    - CVE-2026-22021: JSSE: unauthenticated attacker with network access via HTTPS can cause a partial denial     of service       (bsc#1262497).
    - CVE-2026-23865: freetype2: integer overflow in the `tt_var_load_item_variation_store` function allows     for an       out-of-bounds read when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts(bsc#1259118).
    - CVE-2026-34268: Security: unauthenticated attacker with logon to the infrastructure where java executes     can gain       unauthorized read access to a subset of data (bsc#1262500).
    - CVE-2026-34282: Networking: unauthenticated attacker with network access via multiple protocols can     cause a hang or       frequently repeatable crash (bsc#1262501).

    Other updates and bugfixes:

    - Provide the timezone-java and tzdata-java (jsc#PED-15898).
    - Migrate to the new logic of FIPS patch developed by RedHat in https://github.com/rh-     openjdk/jdk/tree/fips-25u.
    - Add the sources of /nss-native-fips-key-import-export-adapter.
      * This native library is an adapter for OpenJDK to use the NSS PKCS #11 software token (libsoftokn3.so)     in FIPS mode.
    - Allow overriding of gcc name.
    - Don't make missing system crypto-policies fatal.
    - Add create-crypto-properties-files.bash that generates during the build the config files for different     fips and       non-fips scenarios.
    - Add TestSecurityProperties.java to test the loading of system security properties where applicable.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1686 advisory.

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows     unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read     access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible     data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a     web service which supplies data to the APIs. This vulnerability also applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts).  CVSS Vector:
    (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). (CVE-2026-22007)

    Vulnerability in Oracle Java SE (component: Libraries).   The supported version that is affected is Oracle     Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result     in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2026-22008)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JGSS).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized     access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted     code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). (CVE-2026-22013)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs     in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). (CVE-2026-22016)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2026-22018)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for     JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM     for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2026-22021)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows     unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read     access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible     data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a     web service which supplies data to the APIs. This vulnerability also applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts).  CVSS Vector:
    (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). (CVE-2026-34268)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE:
    8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and  21.0.10; Oracle     GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). (CVE-2026-34282)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-562:06 advisory.

    * JDK: Enhance crypto algorithm support (CVE-2026-22007)
      * JDK: Improved Arena allocations (CVE-2026-22008)
      * JDK: Improve Kerberos credentialing (CVE-2026-22013)
      * JDK: Enhance Path Factories Redux (CVE-2026-22016)
      * JDK: Enhance Zip file reading (CVE-2026-22018)
      * JDK: Enhance certificate chain validation (CVE-2026-22021)
      * JDK: Updating FreeType 2.14.1 (CVE-2026-23865)
      * JDK: Enhance TLS connection handling (CVE-2026-34282)
      * JDK: Enhance key generation (CVE-2026-34268)     This release also updates a number of third-party libraries included in the JDK. The libraries themselves     are affected by the following CVEs, but this is not a statement that the JDK itself is affected:
      * giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)
      * libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette     expansion (CVE-2026-33636)
      * libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6246 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6246-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 03, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : openjdk-25     CVE ID         : CVE-2026-22007 CVE-2026-22008 CVE-2026-22013 CVE-2026-22016                      CVE-2026-22018 CVE-2026-22021 CVE-2026-34268 CVE-2026-34282

    Several vulnerabilities have been discovered in the OpenJDK Java runtime,     which may result in incorrect generation of cryptographic keys, denial of     service, information disclosure, XEE/XEE attacks or incorrect validation     of Kerberos credentials.

    For the stable distribution (trixie), these problems have been fixed in     version 25.0.3+9-2~deb13u1.

    We recommend that you upgrade your openjdk-25 packages.

    For the detailed security status of openjdk-25 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openjdk-25

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenJDK installed on the remote host is 8 prior to 8u482 / 11.0.0 prior to 11.0.30 / 17.0.0 prior to 17.0.18 / 21.0.0 prior to 21.0.10 / 25.0.0 prior to 25.0.2 / 26.0.0 prior to 26.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026-04-21 advisory.

Please Note: Java CVEs do not always include OpenJDK versions, but are confirmed separately by Tenable using the patch versions from the referenced OpenJDK security advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2026-22016)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE:
    8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle     GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a     hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. (CVE-2026-34282)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2026-22021)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than     the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data     or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2026-22013)

  - An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions     2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in     OpenType variable fonts. This issue is fixed in version 2.14.2. (CVE-2026-23865)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:9693 advisory.

    * JDK: Enhance crypto algorithm support (CVE-2026-22007)
      * JDK: Improved Arena allocations (CVE-2026-22008)
      * JDK: Improve Kerberos credentialing (CVE-2026-22013)
      * JDK: Enhance Path Factories Redux (CVE-2026-22016)
      * JDK: Enhance Zip file reading (CVE-2026-22018)
      * JDK: Enhance certificate chain validation (CVE-2026-22021)
      * JDK: Updating FreeType 2.14.1 (CVE-2026-23865)
      * JDK: Enhance TLS connection handling (CVE-2026-34282)
      * JDK: Enhance key generation (CVE-2026-34268)


    This release also updates a number of third-party libraries included in the JDK. The libraries themselves     are affected by the following CVEs, but this is not a statement that the JDK itself is affected:

      * giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)
      * libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette     expansion (CVE-2026-33636)
      * libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)


    Bug Fix(es):

      * When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance     reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 25 releases, a     response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is     rectified in this release. (AlmaLinux-169939, AlmaLinux-169937)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-9693 advisory.

    [1:25.0.3.0.9-1.0.1]
    - Add Oracle vendor bug URL [Orabug: 34340155]

    [1:25.0.3.0.9-1]
    - Update to jdk-25.0.3+9 (GA)
    - Update release notes to 25.0.3+9
    - Update FIPS patch to 57722aab802 version synced with 25.0.3+8
    - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream
    - Drop local HarfBuzz patch now JDK-8375057 is included upstream
    - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
    - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
    - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047
    - Bump zlib version to 1.3.2 following JDK-8378631
    - Bump tzdata version to 2026a following JDK-8379035
    - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4
    - Sync the copy of the portable specfile with the latest update
    - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
    - Resolves: RHEL-169620
    - Resolves: RHEL-157091
    - Resolves: RHEL-161217
    - Resolves: RHEL-161333
    - Resolves: RHEL-169613

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9693 advisory.

    The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software     Development Kit.

    Security Fix(es):

    * JDK: Enhance crypto algorithm support (CVE-2026-22007)

    * JDK: Improved Arena allocations (CVE-2026-22008)

    * JDK: Improve Kerberos credentialing (CVE-2026-22013)

    * JDK: Enhance Path Factories Redux (CVE-2026-22016)

    * JDK: Enhance Zip file reading (CVE-2026-22018)

    * JDK: Enhance certificate chain validation (CVE-2026-22021)

    * JDK: Updating FreeType 2.14.1 (CVE-2026-23865)

    * JDK: Enhance TLS connection handling (CVE-2026-34282)

    * JDK: Enhance key generation (CVE-2026-34268)

    This release also updates a number of third-party libraries included in the JDK.  The libraries themselves     are affected by the following CVEs, but this is not a statement that the JDK itself is affected:

    * giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)

    * libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette     expansion (CVE-2026-33636)

    * libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

    Bug Fix(es):

    * When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance     reasons, only falling back to sendfile when this fails.  However, in previous OpenJDK 25 releases, a     response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile.  This is     rectified in this release. (RHEL-169939, RHEL-169937)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle     Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result     in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2026-22008)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Java installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. (CVE-2026-22016)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf,     11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise     Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via     multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
    Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web     service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted     code (e.g., code that comes from the internet) and rely on the Java sandbox for security. (CVE-2026-34282)

  - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and     iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A remote attacker may be able to     cause a denial-of-service. (CVE-2026-20652)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Azul Zulu installed on the remote host is 6 prior to 6.79.0.14 / 7 prior to 7.85.0.12 / 8 prior to 8.93.0.18 / 11 prior to 11.87.18 / 17 prior to 17.65.18 / 21 prior to 21.49.18 / 25 prior to 25.33.16 / 26 prior to 26.30.12. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026-04-21 advisory.

  - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and     iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A remote attacker may be able to     cause a denial-of-service. (CVE-2026-20652)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated     attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note:
    This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service     which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code     (e.g., code that comes from the internet) and rely on the Java sandbox for security. (CVE-2026-22007,     CVE-2026-34268)

  - Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle     Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result     in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2026-22008)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than     the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data     or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2026-22013)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2026-22016)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
313706	openSUSE 16 Security Update : java-25-openjdk (openSUSE-SU-2026:20672-1)	Nessus	SuSE Local Security Checks	high
313686	SUSE SLED15 / SLES15 Security Update : java-25-openjdk (SUSE-SU-2026:1704-1)	Nessus	SuSE Local Security Checks	high
313523	Amazon Linux 2023 : java-25-amazon-corretto, java-25-amazon-corretto-devel, java-25-amazon-corretto-headless (ALAS2023-2026-1686)	Nessus	Amazon Linux Local Security Checks	high
313428	MiracleLinux 9 : java-25-openjdk-25.0.3.0.9-1.el9.ML.1 (AXSA:2026-562:06)	Nessus	Miracle Linux Local Security Checks	high
311815	Debian dsa-6246 : openjdk-25-dbg - security update	Nessus	Debian Local Security Checks	high
310406	OpenJDK 8 <= 8u482 / 11.0.0 <= 11.0.30 / 17.0.0 <= 17.0.18 / 21.0.0 <= 21.0.10 / 25.0.0 <= 25.0.2 / 26.0.0 <= 26.0.0 Multiple Vulnerabilities (2026-04-21)	Nessus	Misc.	high
310149	AlmaLinux 10 : java-25-openjdk (ALSA-2026:9693)	Nessus	Alma Linux Local Security Checks	high
310026	Oracle Linux 10 / 9 : java-25-openjdk (ELSA-2026-9693)	Nessus	Oracle Linux Local Security Checks	high
309745	RHEL 10 / 9 : java-25-openjdk (RHSA-2026:9693)	Nessus	Red Hat Local Security Checks	high
309648	Linux Distros Unpatched Vulnerability : CVE-2026-22008	Nessus	Misc.	low
309197	Oracle Java SE Multiple Vulnerabilities (April 2026 CPU)	Nessus	Misc.	high
309082	Azul Zulu Java Multiple Vulnerabilities (2026-04-21)	Nessus	Misc.	high

Detections

Analytics

CVE-2026-22008

low

Tenable Plugins

high

high

high

high

high

high

high

high

high

low

high

high