An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (via dtrace -p , pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without any bounds check. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of the dtrace process (DoS), or -- depending on heap layout -- a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context.

The version of Solaris installed on the remote host is prior to 11.4.93.221.2. It is, therefore, affected by multiple vulnerabilities as referenced in the solaris11_jun2026_SRU11_4_93_221_2 advisory.

  - Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon).
    The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Oracle Solaris. While the vulnerability is in Oracle     Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized creation, deletion or modification access to critical data or all     Oracle Solaris accessible data as well as unauthorized access to critical data or complete access to all     Oracle Solaris accessible data. (CVE-2026-46978)

  - Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported     version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with     logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks     of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle     Solaris accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Oracle Solaris. (CVE-2026-46914)

  - Vulnerability in the Oracle Solaris product of Oracle Systems (component: Libraries). The supported     version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with     logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks     of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Solaris     accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle     Solaris. (CVE-2026-35233)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-     range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (via dtrace -p ,     pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without     any bounds check. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer     dereference crash of the dtrace process (DoS), or -- depending on heap layout -- a read-then-use of a     garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a     privileged context. (CVE-2026-35233)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50249 advisory.

    - Prevent out-of-buonds memory access during object symbol table construction       (CVE-2026-35233).  [Orabug: 39121881]
    - Prevent divide-by-zero (FPE trap) if section header data is corrupted.
      (CVE-2026-21996).  [Orabug: 39121874]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50250 advisory.

    - Prevent out-of-buonds memory access during object symbol table construction       (CVE-2026-35233).  [Orabug: 39121881]
    - Prevent divide-by-zero (FPE trap) if section header data is corrupted.
      (CVE-2026-21996).  [Orabug: 39121874]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50251 advisory.

    - Prevent out-of-buonds memory access during object symbol table construction       (CVE-2026-35233).  [Orabug: 39121881]
    - Prevent divide-by-zero (FPE trap) if section header data is corrupted.
      (CVE-2026-21996).  [Orabug: 39121874]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
322226	Oracle Solaris Critical Patch Update : jun2026_SRU11_4_93_221_2	Nessus	Solaris Local Security Checks	critical
312205	Linux Distros Unpatched Vulnerability : CVE-2026-35233	Nessus	Misc.	medium
311358	Oracle Linux 10 / 9 : dtrace (ELSA-2026-50249)	Nessus	Oracle Linux Local Security Checks	medium
311356	Oracle Linux 8 / 9 : dtrace (ELSA-2026-50250)	Nessus	Oracle Linux Local Security Checks	medium
311354	Oracle Linux 8 : dtrace (ELSA-2026-50251)	Nessus	Oracle Linux Local Security Checks	medium

Detections

Analytics

CVE-2026-35233

medium

Tenable Plugins

critical

medium

medium

medium

medium