Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue.

The version of SolarWinds DameWare Mini Remote Control installed on the remote host is prior to 2026.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Dameware 2026.3.1 release notes.

  - A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through     1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory,     disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a     crafted Brotli-compressed stream. (CVE-2026-111497)

  - SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the     compromise of the remotely controlled host. Authentication is required. (CVE-2026-28336)

  - SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code     execution. Authentication is required. (CVE-2026-28335)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-6515ac01d8 advisory.

    Update log4net to 3.5.0. Nant is rebuilt (only dependency in Fedora).


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-588bc7e01c advisory.

    Update log4net to 3.5.0. Nant is rebuilt (only dependency in Fedora).


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-0bf84c3130 advisory.

    Update log4net to 3.5.0. Nant is rebuilt (only dependency in Fedora).


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-
    list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-
    list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification
    https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that
    may carry attacker-influenced data. This causes an exception during serialization and the silent loss of
    the affected log event. An attacker who can influence any of these fields can exploit this to suppress
    individual log records, impairing audit trails and detection of malicious activity. Users are advised to
    upgrade to Apache Log4net 3.3.0, which fixes this issue. (CVE-2026-40021)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-     list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-     list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification     https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that     may carry attacker-influenced data. This causes an exception during serialization and the silent loss of     the affected log event. An attacker who can influence any of these fields can exploit this to suppress     individual log records, impairing audit trails and detection of malicious activity. Users are advised to     upgrade to Apache Log4net 3.3.0, which fixes this issue. (CVE-2026-40021)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
377037	SolarWinds DameWare Mini Remote Control < 2026.3.1 Multiple Vulnerabilities	Nessus	Windows	Local	critical
374575	Fedora 45 : log4net / nant (2026-6515ac01d8)	Nessus	Fedora Local Security Checks	Local	medium
366631	Fedora 43 : log4net / nant (2026-588bc7e01c)	Nessus	Fedora Local Security Checks	Local	medium
366623	Fedora 44 : log4net / nant (2026-0bf84c3130)	Nessus	Fedora Local Security Checks	Local	medium
440340	SCA: security update for log4net (GHSA-4f7c-pmjv-c25w)	Tenable Cloud Security	SCA Checks	Local	medium
440340	SCA: security update for log4net (GHSA-4f7c-pmjv-c25w)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
306027	Linux Distros Unpatched Vulnerability : CVE-2026-40021	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-40021

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium