The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been executed. Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <= 2.1.10, and 2.2.0 <= 2.2.5. The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying the classname allowlist earlier. Affected are applications using Apache MINA that call IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade

The version of Oracle Business Process Management Suite installed on the remote host is affected by multiple vulnerabilities, as referenced in the July 2026 CPU advisory:

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Human Workflow). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily     exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise     Oracle Business Process Management Suite. While the vulnerability is in Oracle Business Process Management     Suite, attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in takeover of Oracle Business Process Management Suite. (CVE-2026-60542)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: BPM Foundation Services (Apache Mina)). Supported versions that are affected are 12.2.1.4.0 and     14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can result in     takeover of Oracle Business Process Management Suite. (CVE-2026-41409)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Runtime Engine (Apache Log4j)). Supported versions that are affected are 12.2.1.4.0 and     14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Oracle Business Process     Management Suite accessible data. (CVE-2026-34481)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname
    allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class
    to be read might already have been executed. Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <=
    2.1.10, and 2.2.0 <= 2.2.5. The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying
    the classname allowlist earlier. Affected are applications using Apache MINA that call
    IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade (CVE-2026-41409)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname     allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class     to be read might already have been executed. Affected versions are Apache MINA 2.0.0 <= 2.0.27, 2.1.0 <=     2.1.10, and 2.2.0 <= 2.2.5. The problem is resolved in Apache MINA 2.0.28, 2.1.11, and 2.2.6 by applying     the classname allowlist earlier. Affected are applications using Apache MINA that call     IoBuffer.getObject(). Applications using Apache MINA are advised to upgrade (CVE-2026-41409)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
329070	Oracle Business Process Management Suite (12.2.1.4.0 / 14.1.2.0.0) (July 2026 CPU)	Nessus	Misc.	Local	medium
441263	SCA: security update for org.apache.mina:mina-core (GHSA-f2wh-grmh-r6jm)	Tenable Cloud Security	SCA Checks	Local	critical
441263	SCA: security update for org.apache.mina:mina-core (GHSA-f2wh-grmh-r6jm)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
310668	Linux Distros Unpatched Vulnerability : CVE-2026-41409	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-41409

critical

Tenable Plugins

medium

critical

critical

critical