Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.

Add IAVM ID - Multiple Vulnerabilities in Apache ZooKeeper

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.6.1.1 prior or equal to 9.6.1.13 or 9.7.2.1 prior or equal to 9.7.2.11. It is, therefore, affected by multiple vulnerabilities as referenced in the 7279145 advisory.

  - IBM DOORS Web Access do not limit the length of a connection which could allow for a Slowloris HTTP denial     of service attack to take place. This can cause the web server to become unresponsive. (CVE-2024-25039)

  - IBM DOORS Web Access is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated     attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality     potentially leading to credentials disclosure within a trusted session. (CVE-2025-0152)

  - IBM DOORS Web Access could allow a remote attacker to obtain sensitive information when a detailed     technical error message is returned in the browser. This information could be used in further attacks     against the system. (CVE-2020-4984)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component:
    Integration (Lodash)). Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15,     23.12.0-23.12.16, 24.12.0-24.12.14 and 25.12.0-25.12.6. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks     of this vulnerability can result in takeover of Primavera Unifier. (CVE-2026-4800)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component:
    Integration (Apache ZooKeeper)). Supported versions that are affected are 21.12.0-21.12.17,     22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.14 and 25.12.0-25.12.6. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful     attacks of this vulnerability can result in unauthorized access to critical data or complete access to all     Primavera Unifier accessible data. (CVE-2026-24308)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Apache Log4j)). Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15,     23.12.0-23.12.16, 24.12.0-24.12.14 and 25.12.0-25.12.6. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks     of this vulnerability can result in unauthorized creation, deletion or modification access to critical data     or all Primavera Unifier accessible data. (CVE-2026-34481)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache ZooKeeper listening on the remote host is 3.8.x prior to 3.8.6 or 3.9.x prior to 3.9.5. It is, therefore, affected by multiple vulnerabilities:

  - Improper handling of configuration values in ZKConfig allows an attacker to expose sensitive     information stored in client configuration in the client's logfile. Configuration values are     exposed at INFO level logging, rendering potential production systems affected by the issue.
    (CVE-2026-24308)

  - Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR)     when IP SAN validation fails, allowing attackers who control or spoof PTR records to     impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. Note     that an attacker must present a certificate which is trusted by ZKTrustManager, which makes     the attack vector harder to exploit. (CVE-2026-24281)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms     allows an attacker to expose sensitive information stored in client configuration in the client's logfile.
    Configuration values are exposed at INFO level logging rendering potential production systems affected by     the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
    (CVE-2026-24308)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms
    allows an attacker to expose sensitive information stored in client configuration in the client's logfile.
    Configuration values are exposed at INFO level logging rendering potential production systems affected by
    the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
    (CVE-2026-24308)

ID	Name	Product	Family	Type	Severity
333335	IBM Engineering Requirements Management DOORS 9.6.1.1 <= 9.6.1.13 / 9.7.2.1 < 9.7.2.11 Multiple Vulnerabilities (7279145)	Nessus	Windows	Local	high
329220	Oracle Primavera Unifier (July 2026 CPU)	Nessus	CGI abuses	Remote	medium
301976	Apache ZooKeeper 3.8.x < 3.8.6 / 3.9.x < 3.9.5 Multiple Vulnerabilities	Nessus	Misc.	Combined	high
301666	Linux Distros Unpatched Vulnerability : CVE-2026-24308	Nessus	Misc.	Local	high
438506	SCA: security update for org.apache.zookeeper:zookeeper (GHSA-crhr-qqj8-rpxc)	Tenable Cloud Security	SCA Checks	Local	high
438506	SCA: security update for org.apache.zookeeper:zookeeper (GHSA-crhr-qqj8-rpxc)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-24308

high

Tenable Plugins

Coming Soon

high

medium

high

high

high

high