Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters. The impact depends on the StAX implementation in use: * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records. * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.6.1.1 prior or equal to 9.6.1.13 or 9.7.2.1 prior or equal to 9.7.2.11. It is, therefore, affected by multiple vulnerabilities as referenced in the 7279145 advisory.

  - IBM DOORS Web Access do not limit the length of a connection which could allow for a Slowloris HTTP denial     of service attack to take place. This can cause the web server to become unresponsive. (CVE-2024-25039)

  - IBM DOORS Web Access is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated     attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality     potentially leading to credentials disclosure within a trusted session. (CVE-2025-0152)

  - IBM DOORS Web Access could allow a remote attacker to obtain sensitive information when a detailed     technical error message is returned in the browser. This information could be used in further attacks     against the system. (CVE-2020-4984)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 21.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory.

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Service Manager). Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle     GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60157)

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Microservices). Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle     GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60398)

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Admin Server Executable).
    Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise     Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 23.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory.

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Service Manager). Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle     GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60157)

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Microservices). Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle     GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60398)

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Admin Server Executable).
    Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise     Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 19.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory.

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Service Manager). Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle     GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60157)

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Microservices). Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle     GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60398)

  - Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Admin Server Executable).
    Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise     Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate.
    (CVE-2026-60400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 version of WebLogic Server installed on the remote host is affected by a vulnerability as referenced in the July 2026 CPU advisory.

  - Apache Log4j Core's XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters     forbidden by the XML 1.0 specification, producing invalid XML output whenever a log message or MDC value     contains such characters. Apache Log4j is a third-party component bundled with Oracle WebLogic Server.
    (CVE-2026-34480)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.6 advisory.

  - NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator     that enables denial of service and possible remote code execution as a result of deep copying a data     structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by     controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend     validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-     copies response messages to preserve them across memory region teardown. A struct-assignment bug     overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the     resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary     code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep     copying the data structure. (CVE-2026-33278)

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in     the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The     identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended     to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in     the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable     characters (which would need escaping), the calculation of the length of the escaped string could     overflow, leading to a potential write off the end of the newly allocated string. (CVE-2025-13601)

  - Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in     Vim's tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation     can lead to overwriting sensitive files or placing executable code in privileged locations, depending on     the permissions of the process editing the archive. The victim must edit such a file using Vim which will     reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying     operating system. Version 9.1.1552 contains a patch for the vulnerability. (CVE-2025-53905)

  - Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in     Vim's zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation     can lead to overwriting sensitive files or placing executable code in privileged locations, depending on     the permissions of the process editing the archive. The victim must edit such a file using Vim which will     reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying     operating system. Version 9.1.1551 contains a patch for the vulnerability. (CVE-2025-53906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 13.5 and 24.1 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the June 2026 CSPU advisory.

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Target Management). Supported versions that are affected are 13.5 and 24.1. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise     Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base     Platform, attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. (CVE-2026-46854)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Discovery Framework). Supported versions that are affected are 13.5 and 24.1. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise     Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base     Platform, attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. (CVE-2026-46832)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise     Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may     significantly impact additional products (scope change). Successful attacks of this vulnerability can     result in takeover of Oracle Enterprise Manager Base Platform. (CVE-2026-46852)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1843-1 advisory.

    - CVE-2026-34477: TLS connections vulnerable to interception due to incomplete hostname verification     configuration       checks (bsc#1262050).
    - CVE-2026-34479: silent log event loss due to improper XML escaping in `Log4j1XmlLayout` (bsc#1262091).
    - CVE-2026-34480: silent log event loss due to improper XML escaping in `XmlLayout` (bsc#1262092).
    - CVE-2026-34481: silent log event loss due to improper serialization of non-finite floating-point values     in       `JsonTemplateLayout` (bsc#1262093).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache Log4j on the remote host is 2.0-alpha1 through 2.25.3. It is, therefore, affected by a vulnerability:

  - The XmlLayout fails to sanitize characters forbidden by the XML 1.0 specification, producing invalid XML     output whenever a log message or MDC value contains such characters. Depending on the StAX implementation,     this causes either malformed XML or exceptions during logging. (CVE-2026-34480)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in
    versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification
    https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value
    contains such characters. The impact depends on the StAX implementation in use: * JRE built-in StAX:
    Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must
    reject such documents with a fatal error, which may cause downstream log-processing systems to drop the
    affected records. * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox
    , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging
    call, and the log event is never delivered to its intended appender, only to Log4j's internal status
    logger. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing
    forbidden characters before XML output. (CVE-2026-34480)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in     versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification     https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value     contains such characters. The impact depends on the StAX implementation in use: * JRE built-in StAX:
    Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must     reject such documents with a fatal error, which may cause downstream log-processing systems to drop the     affected records. * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox     , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging     call, and the log event is never delivered to its intended appender, only to Log4j's internal status     logger. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing     forbidden characters before XML output. (CVE-2026-34480)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
333335	IBM Engineering Requirements Management DOORS 9.6.1.1 <= 9.6.1.13 / 9.7.2.1 < 9.7.2.11 Multiple Vulnerabilities (7279145)	Nessus	Windows	Local	high
329213	Oracle GoldenGate 21.x < 21.23.0.0.0 (July 2026 CPU)	Nessus	Misc.	Local	high
329212	Oracle GoldenGate 23.x < 23.26.3.0.0 (July 2026 CPU)	Nessus	Misc.	Local	high
329211	Oracle GoldenGate 19.x < 19.32.0.0.260721 (July 2026 CPU)	Nessus	Misc.	Local	medium
329168	Oracle WebLogic Server Apache Log4j (July 2026 CPU) (12.2.1.4.0)	Nessus	Misc.	Local	medium
328839	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.6)	Nessus	Misc.	Local	critical
321531	Oracle Enterprise Manager Cloud Control (June 2026 CSPU)	Nessus	Misc.	Local	medium
315047	SUSE SLED15 / SLES15 Security Update : log4j (SUSE-SU-2026:1843-1)	Nessus	SuSE Local Security Checks	Local	medium
306549	Apache Log4j 2.0-alpha1 < 2.25.4 XmlLayout Invalid XML Output (CVE-2026-34480)	Nessus	Misc.	Local	medium
440322	SCA: security update for org.apache.logging.log4j:log4j-core (GHSA-3pxv-7cmr-fjr4)	Tenable Cloud Security	SCA Checks	Local	medium
440322	SCA: security update for org.apache.logging.log4j:log4j-core (GHSA-3pxv-7cmr-fjr4)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
306043	Linux Distros Unpatched Vulnerability : CVE-2026-34480	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-34480

medium

Tenable Plugins

high

high

high

medium

medium

critical

medium

medium

medium

medium

medium

medium