cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This vulnerability is fixed in 46.0.5.

According to the versions of the python-cryptography packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
    Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()),     EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not     verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation     allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security     issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key     negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this     leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor  1,     this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA     , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This     vulnerability is fixed in 46.0.5.(CVE-2026-26007)

Tenable has extracted the preceding description block directly from the EulerOS python-cryptography security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19355 advisory.

    - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526       Resolves: RHEL-182313
    - bundled pyasn1: fix CVE-2026-30922       Resolves: RHEL-157202
    - bundled cryptography: replace with dependency to fix CVE-2026-26007

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-13672 advisory.

    - bundled cryptography: replace with dependency to fix CVE-2026-26007

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22330 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves     (CVE-2026-26007)

    * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19355 advisory.

    * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves     (CVE-2026-26007)

    * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

    * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:21517 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves     (CVE-2026-26007)

    * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:21431 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves     (CVE-2026-26007)

    * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:19355 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves     (CVE-2026-26007)

    * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

    * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:13672 advisory.

    * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves     (CVE-2026-26007)

    * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:13672 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves     (CVE-2026-26007)

    * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:13512 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):
    * automation-controller: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * automation-controller: PyJWT accepts unknown `crit` header extensions (RFC 7515 4.1.11 MUST violation)     (CVE-2026-32597)
    * automation-controller: denial of service via malformed HTML-like sequences (CVE-2025-69534)
    * automation-controller: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves     (CVE-2026-26007)
    * automation-gateway: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * automation-gateway: Rollup: Remote Code Execution via Path Traversal Vulnerability (CVE-2026-27606)
    * automation-gateway: SVGO: Denial of Service via XML entity expansion (CVE-2026-29074)
    * automation-gateway: ReDoS via $data reference (CVE-2025-69873)
    * automation-gateway-proxy: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
    * python3.12-django-ansible-base: Account hijacking and unauthorized access via unverified email linking     (CVE-2026-6266)
    * python3.12-markdown: denial of service via malformed HTML-like sequences (CVE-2025-69534)
    * python3.12-jwcrypto: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)
    * python3.12-pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)
    * python3.12-pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID     (CVE-2026-23490)
    * python3.12-pyOpenSSL: DTLS cookie callback buffer overflow (CVE-2026-27459)
    * receptor: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-538:07 advisory.

    * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves     (CVE-2026-26007)
      * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation)     (CVE-2026-32597)
      * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:12176 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves     (CVE-2026-26007)

    * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

    * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-12176 advisory.

    - bundled cryptography: replace with dependency to fix CVE-2026-26007
    - bundled PyJWT: replace with dependency to fix CVE-2026-32597

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:12176 advisory.

    * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves     (CVE-2026-26007)
      * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation)     (CVE-2026-32597)
      * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:12176 advisory.

    * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves     (CVE-2026-26007)

    * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

    * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory.

  - Security-in-Depth issue in the Spatial and Graph (SQLite) component of Oracle Database Server. This     vulnerability cannot be exploited in the context of this product. (CVE-2025-6965)

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are     19.3-19.30 and 21.3-21.21. Easily exploitable vulnerability allows unauthenticated attacker with network     access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Java VM accessible data. (CVE-2026-35229)

  - Vulnerability in the Clusterware (Micronaut) component of Oracle Database Server. Supported versions that     are affected are 19.3-19.30 and 23.4.0-23.26.1. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Clusterware (Micronaut). Successful attacks of this     vulnerability can result in unauthorized creation, deletion or modification access to critical data or all     Clusterware (Micronaut) accessible data. (CVE-2026-33013, CVE-2026-33870)

  - Vulnerability in the RDBMS (OpenSSL) component of Oracle Database Server. Supported versions that are     affected are 19.3-19.30 and 23.4.0-23.26.1. Easily exploitable vulnerability allows high privileged     attacker having None privilege with network access via multiple protocols to compromise RDBMS (OpenSSL).
    Successful attacks of this vulnerability can result in takeover of RDBMS (OpenSSL). (CVE-2026-31790)

  - Vulnerability in the RDBMS (Python) component of Oracle Database Server. Supported versions that are     affected are 21.3-21.21 and 23.4.0-23.26.1. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise RDBMS (Python). Successful attacks     require human interaction from a person other than the attacker. Successful attacks of this vulnerability     can result in unauthorized access to critical data or complete access to all RDBMS (Python) accessible     data. (CVE-2026-26007)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has a package installed that is affected by a vulnerability as referenced in the USN-8087-1 advisory.

    It was discovered that python-cryptography incorrectly handled subgroup validation for SECT curves. A     remote attacker could use this issue to perform a subgroup attack and possibly recover the least     significant bits of private keys.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
    Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()),
    EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not
    verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation
    allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security
    issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key
    negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this
    leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this
    reveals the least significant bits of the private key. When these weak public keys are used in ECDSA ,
    it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This
    vulnerability is fixed in 46.0.5. (CVE-2026-26007)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
    Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()),     EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not     verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation     allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security     issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key     negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this     leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this     reveals the least significant bits of the private key. When these weak public keys are used in ECDSA ,     it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This     vulnerability is fixed in 46.0.5. (CVE-2026-26007)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
323180	EulerOS 2.0 SP15 : python-cryptography (EulerOS-SA-2026-2459)	Nessus	Huawei Local Security Checks	high
323172	EulerOS 2.0 SP15 : python-cryptography (EulerOS-SA-2026-2500)	Nessus	Huawei Local Security Checks	high
323113	Oracle Linux 9 : fence-agents (ELSA-2026-19355)	Nessus	Oracle Linux Local Security Checks	high
322303	Oracle Linux 9 : fence-agents (ELSA-2026-13672)	Nessus	Oracle Linux Local Security Checks	high
319592	RHEL 9 : fence-agents (RHSA-2026:22330)	Nessus	Red Hat Local Security Checks	high
318042	RockyLinux 9 : fence-agents (RLSA-2026:19355)	Nessus	Rocky Linux Local Security Checks	high
317378	RHEL 9 : fence-agents (RHSA-2026:21517)	Nessus	Red Hat Local Security Checks	high
317337	RHEL 9 : fence-agents (RHSA-2026:21431)	Nessus	Red Hat Local Security Checks	high
315456	RHEL 9 : fence-agents (RHSA-2026:19355)	Nessus	Red Hat Local Security Checks	high
312328	RockyLinux 9 : fence-agents (RLSA-2026:13672)	Nessus	Rocky Linux Local Security Checks	high
312175	RHEL 9 : fence-agents (RHSA-2026:13672)	Nessus	Red Hat Local Security Checks	high
312098	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2026:13512)	Nessus	Red Hat Local Security Checks	critical
311946	MiracleLinux 8 : fence-agents-4.2.1-129.el8_10.25 (AXSA:2026-538:07)	Nessus	Miracle Linux Local Security Checks	high
311515	RHEL 8 : fence-agents (RHSA-2026:12176)	Nessus	Red Hat Local Security Checks	high
311355	Oracle Linux 8 : fence-agents (ELSA-2026-12176)	Nessus	Oracle Linux Local Security Checks	high
311296	AlmaLinux 8 : fence-agents (ALSA-2026:12176)	Nessus	Alma Linux Local Security Checks	high
311281	RockyLinux 8 : fence-agents (RLSA-2026:12176)	Nessus	Rocky Linux Local Security Checks	high
310136	Oracle Database Server (April 2026 CPU)	Nessus	Databases	high
302210	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : python-cryptography vulnerability (USN-8087-1)	Nessus	Ubuntu Local Security Checks	high
438399	Alpine: py3-cryptography: security update to 46.0.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
438399	Alpine: py3-cryptography: security update to 46.0.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
437685	SCA: security update for cryptography (GHSA-r6ph-v2qm-q3c2)	Tenable Cloud Security	SCA Checks	high
437685	SCA: security update for cryptography (GHSA-r6ph-v2qm-q3c2)	Tenable Self-Hosted Container Security	SCA Checks	high
298585	Linux Distros Unpatched Vulnerability : CVE-2026-26007	Nessus	Misc.	high

Detections

Analytics

CVE-2026-26007

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high