Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.

oracle CPUOct2026: MySQL Cluster >=9.7.0|<=9.7.4

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.38

oracle CPUOct2026: MySQL Cluster >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.50

oracle CPUOct2026: MySQL Cluster >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Server >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=9.7.0|<=9.7.4

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.
    This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to
    version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, Shiro-native
    session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure'
    attribute by default. (CVE-2026-43828)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.
    This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to     version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, Shiro-native     session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure'     attribute by default. (CVE-2026-43828)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
444160	SCA: security update for org.apache.shiro:shiro-web (GHSA-c6r4-qjmw-cvj2)	Tenable Cloud Security	SCA Checks	Local	medium
444160	SCA: security update for org.apache.shiro:shiro-web (GHSA-c6r4-qjmw-cvj2)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
316788	Linux Distros Unpatched Vulnerability : CVE-2026-43828	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-43828

medium

Tenable Plugins

Coming Soon

medium

medium

medium