The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the <Ssl> element. Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value. A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met: * An SMTP, Socket, or Syslog appender is in use. * TLS is configured via a nested <Ssl> element. * The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured. This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.

The 13.5 and 24.1 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the June 2026 CSPU advisory.

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Target Management). Supported versions that are affected are 13.5 and 24.1. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise     Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base     Platform, attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. (CVE-2026-46854)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Discovery Framework). Supported versions that are affected are 13.5 and 24.1. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise     Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base     Platform, attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. (CVE-2026-46832)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise     Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may     significantly impact additional products (scope change). Successful attacks of this vulnerability can     result in takeover of Oracle Enterprise Manager Base Platform. (CVE-2026-46852)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1843-1 advisory.

    - CVE-2026-34477: TLS connections vulnerable to interception due to incomplete hostname verification     configuration       checks (bsc#1262050).
    - CVE-2026-34479: silent log event loss due to improper XML escaping in `Log4j1XmlLayout` (bsc#1262091).
    - CVE-2026-34480: silent log event loss due to improper XML escaping in `XmlLayout` (bsc#1262092).
    - CVE-2026-34481: silent log event loss due to improper serialization of non-finite floating-point values     in       `JsonTemplateLayout` (bsc#1262093).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache Log4j on the remote host is 2.12.0 through 2.25.3. It is, therefore, affected by a vulnerability:

  - The verifyHostName configuration attribute of the Ssl element was silently ignored in all versions through     2.25.3, leaving TLS connections vulnerable to interception via man-in-the-middle attacks when using SMTP,     Socket, or Syslog appenders. (CVE-2026-34477)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it     addressed hostname verification only when enabled via the log4j2.sslVerifyHostName     https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system     property, but not when configured through the verifyHostName     https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName     attribute of the <Ssl> element. Although the verifyHostName configuration attribute was introduced in     Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections     vulnerable to interception regardless of the configured value. A network-based attacker may be able to     perform a man-in-the-middle attack when all of the following conditions are met: * An SMTP, Socket, or     Syslog appender is in use. * TLS is configured via a nested <Ssl> element. * The attacker can present a     certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust     store if none is configured. This issue does not affect users of the HTTP appender, which uses a separate     verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-     verifyHostName attribute that was not subject to this bug and verifies host names by default. Users are     advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue. (CVE-2026-34477)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321531	Oracle Enterprise Manager Cloud Control (June 2026 CSPU)	Nessus	Misc.	medium
315047	SUSE SLED15 / SLES15 Security Update : log4j (SUSE-SU-2026:1843-1)	Nessus	SuSE Local Security Checks	medium
306550	Apache Log4j 2.12.0 < 2.25.4 SSL Hostname Verification Bypass (CVE-2026-34477)	Nessus	Misc.	medium
306170	Linux Distros Unpatched Vulnerability : CVE-2026-34477	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-34477

medium

Tenable Plugins

medium

medium

medium

medium