The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the <Ssl> element. Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value. A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met: * An SMTP, Socket, or Syslog appender is in use. * TLS is configured via a nested <Ssl> element. * The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured. This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.

The version of AOS installed on the remote host is prior to 7.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.6 advisory.

  - NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator     that enables denial of service and possible remote code execution as a result of deep copying a data     structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by     controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend     validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-     copies response messages to preserve them across memory region teardown. A struct-assignment bug     overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the     resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary     code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep     copying the data structure. (CVE-2026-33278)

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in     the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The     identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended     to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in     the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable     characters (which would need escaping), the calculation of the length of the escaped string could     overflow, leading to a potential write off the end of the newly allocated string. (CVE-2025-13601)

  - Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in     Vim's tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation     can lead to overwriting sensitive files or placing executable code in privileged locations, depending on     the permissions of the process editing the archive. The victim must edit such a file using Vim which will     reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying     operating system. Version 9.1.1552 contains a patch for the vulnerability. (CVE-2025-53905)

  - Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in     Vim's zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation     can lead to overwriting sensitive files or placing executable code in privileged locations, depending on     the permissions of the process editing the archive. The victim must edit such a file using Vim which will     reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying     operating system. Version 9.1.1551 contains a patch for the vulnerability. (CVE-2025-53906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 13.5 and 24.1 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the June 2026 CSPU advisory.

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Target Management). Supported versions that are affected are 13.5 and 24.1. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise     Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base     Platform, attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. (CVE-2026-46854)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Discovery Framework). Supported versions that are affected are 13.5 and 24.1. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise     Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base     Platform, attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. (CVE-2026-46832)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise     Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may     significantly impact additional products (scope change). Successful attacks of this vulnerability can     result in takeover of Oracle Enterprise Manager Base Platform. (CVE-2026-46852)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1843-1 advisory.

    - CVE-2026-34477: TLS connections vulnerable to interception due to incomplete hostname verification     configuration       checks (bsc#1262050).
    - CVE-2026-34479: silent log event loss due to improper XML escaping in `Log4j1XmlLayout` (bsc#1262091).
    - CVE-2026-34480: silent log event loss due to improper XML escaping in `XmlLayout` (bsc#1262092).
    - CVE-2026-34481: silent log event loss due to improper serialization of non-finite floating-point values     in       `JsonTemplateLayout` (bsc#1262093).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache Log4j on the remote host is 2.12.0 through 2.25.3. It is, therefore, affected by a vulnerability:

  - The verifyHostName configuration attribute of the Ssl element was silently ignored in all versions through     2.25.3, leaving TLS connections vulnerable to interception via man-in-the-middle attacks when using SMTP,     Socket, or Syslog appenders. (CVE-2026-34477)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it
    addressed hostname verification only when enabled via the log4j2.sslVerifyHostName
    https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system
    property, but not when configured through the verifyHostName
    https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName
    attribute of the <Ssl> element. Although the verifyHostName configuration attribute was introduced in
    Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections
    vulnerable to interception regardless of the configured value. A network-based attacker may be able to
    perform a man-in-the-middle attack when all of the following conditions are met: * An SMTP, Socket, or
    Syslog appender is in use. * TLS is configured via a nested <Ssl> element. * The attacker can present a
    certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust
    store if none is configured. This issue does not affect users of the HTTP appender, which uses a separate
    verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-
    verifyHostName attribute that was not subject to this bug and verifies host names by default. Users are
    advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue. (CVE-2026-34477)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it     addressed hostname verification only when enabled via the log4j2.sslVerifyHostName     https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system     property, but not when configured through the verifyHostName     https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName     attribute of the <Ssl> element. Although the verifyHostName configuration attribute was introduced in     Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections     vulnerable to interception regardless of the configured value. A network-based attacker may be able to     perform a man-in-the-middle attack when all of the following conditions are met: * An SMTP, Socket, or     Syslog appender is in use. * TLS is configured via a nested <Ssl> element. * The attacker can present a     certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust     store if none is configured. This issue does not affect users of the HTTP appender, which uses a separate     verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-     verifyHostName attribute that was not subject to this bug and verifies host names by default. Users are     advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue. (CVE-2026-34477)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
328839	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.6)	Nessus	Misc.	critical
321531	Oracle Enterprise Manager Cloud Control (June 2026 CSPU)	Nessus	Misc.	medium
315047	SUSE SLED15 / SLES15 Security Update : log4j (SUSE-SU-2026:1843-1)	Nessus	SuSE Local Security Checks	medium
306550	Apache Log4j 2.12.0 < 2.25.4 SSL Hostname Verification Bypass (CVE-2026-34477)	Nessus	Misc.	medium
440327	SCA: security update for org.apache.logging.log4j:log4j-core (GHSA-6hg6-v5c8-fphq)	Tenable Cloud Security	SCA Checks	medium
440327	SCA: security update for org.apache.logging.log4j:log4j-core (GHSA-6hg6-v5c8-fphq)	Tenable Self-Hosted Container Security	SCA Checks	medium
306170	Linux Distros Unpatched Vulnerability : CVE-2026-34477	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-34477

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium