The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. Two groups of users are affected: * Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class. Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue. Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.6.1.1 prior or equal to 9.6.1.13 or 9.7.2.1 prior or equal to 9.7.2.11. It is, therefore, affected by multiple vulnerabilities as referenced in the 7279145 advisory.

  - IBM DOORS Web Access do not limit the length of a connection which could allow for a Slowloris HTTP denial     of service attack to take place. This can cause the web server to become unresponsive. (CVE-2024-25039)

  - IBM DOORS Web Access is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated     attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality     potentially leading to credentials disclosure within a trusted session. (CVE-2025-0152)

  - IBM DOORS Web Access could allow a remote attacker to obtain sensitive information when a detailed     technical error message is returned in the browser. This information could be used in further attacks     against the system. (CVE-2020-4984)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 13.5 and 24.1 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the June 2026 CSPU advisory.

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Target Management). Supported versions that are affected are 13.5 and 24.1. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise     Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base     Platform, attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. (CVE-2026-46854)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Discovery Framework). Supported versions that are affected are 13.5 and 24.1. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise     Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base     Platform, attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. (CVE-2026-46832)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise     Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may     significantly impact additional products (scope change). Successful attacks of this vulnerability can     result in takeover of Oracle Enterprise Manager Base Platform. (CVE-2026-46852)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1843-1 advisory.

    - CVE-2026-34477: TLS connections vulnerable to interception due to incomplete hostname verification     configuration       checks (bsc#1262050).
    - CVE-2026-34479: silent log event loss due to improper XML escaping in `Log4j1XmlLayout` (bsc#1262091).
    - CVE-2026-34480: silent log event loss due to improper XML escaping in `XmlLayout` (bsc#1262092).
    - CVE-2026-34481: silent log event loss due to improper serialization of non-finite floating-point values     in       `JsonTemplateLayout` (bsc#1262093).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the
    XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents
    containing such characters with a fatal error, which may cause downstream log processing systems to drop
    or fail to index affected records. Two groups of users are affected: * Those using Log4j1XmlLayout
    directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer
    with org.apache.log4j.xml.XMLLayout specified as the layout class. Users are advised to upgrade to Apache
    Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue. Note: The Apache Log4j 1-to-Log4j 2
    bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to
    Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically
    the section on eliminating reliance on the bridge. (CVE-2026-34479)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the     XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents     containing such characters with a fatal error, which may cause downstream log processing systems to drop     or fail to index affected records. Two groups of users are affected: * Those using Log4j1XmlLayout     directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer     with org.apache.log4j.xml.XMLLayout specified as the layout class. Users are advised to upgrade to Apache     Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue. Note: The Apache Log4j 1-to-Log4j 2     bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to     Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically     the section on eliminating reliance on the bridge. (CVE-2026-34479)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
333335	IBM Engineering Requirements Management DOORS 9.6.1.1 <= 9.6.1.13 / 9.7.2.1 < 9.7.2.11 Multiple Vulnerabilities (7279145)	Nessus	Windows	Local	high
321531	Oracle Enterprise Manager Cloud Control (June 2026 CSPU)	Nessus	Misc.	Local	medium
315047	SUSE SLED15 / SLES15 Security Update : log4j (SUSE-SU-2026:1843-1)	Nessus	SuSE Local Security Checks	Local	medium
440329	SCA: security update for org.apache.logging.log4j:log4j-1.2-api (GHSA-h383-gmxw-35v2)	Tenable Cloud Security	SCA Checks	Local	medium
440329	SCA: security update for org.apache.logging.log4j:log4j-1.2-api (GHSA-h383-gmxw-35v2)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
306044	Linux Distros Unpatched Vulnerability : CVE-2026-34479	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-34479

medium

Tenable Plugins

high

medium

medium

medium

medium

medium