In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying * Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must match, Jetty should enforce this invariant.

oracle CPUOct2026: MySQL Cluster >=9.7.0|<=9.7.4

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.38

oracle CPUOct2026: MySQL Cluster >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.50

oracle CPUOct2026: MySQL Cluster >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Server >=9.7.0|<=9.7.4

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory.

  - Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud     Manager). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the     vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products     (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud     Applications. (CVE-2026-101446)

  - Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI (Ruby)).
    Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful     attacks of this vulnerability can result in takeover of Siebel CRM End User. (CVE-2026-54906)

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface     (Apache Tomcat)). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification     access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to     critical data or complete access to all Siebel CRM Deployment accessible data. (CVE-2026-24733,     CVE-2026-41284, CVE-2026-43513, CVE-2026-43515, CVE-2026-59083)

  - Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing).
    Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged     attacker with network access via SQL to compromise Siebel Apps - Life Sciences. Successful attacks of this     vulnerability can result in takeover of Siebel Apps - Life Sciences. (CVE-2026-101457)

  - Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval     Manager). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development. Successful     attacks require human interaction from a person other than the attacker. Successful attacks of this     vulnerability can result in takeover of Siebel CRM Development. (CVE-2026-101495)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request
    authority (host and port) matches what provided in the Host header (if present). This was not enforced in
    earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch
    can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for
    example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying *
    Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must
    match, Jetty should enforce this invariant. (CVE-2026-6790)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request     authority (host and port) matches what provided in the Host header (if present). This was not enforced in     earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch     can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for     example, for redirects -- this is typical for login pages) * Virtual host selection * Reverse proxying *     Misleading logs * Etc. Given that the latest RFCs require that request authority and Host header must     match, Jetty should enforce this invariant. (CVE-2026-6790)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
370447	Oracle Siebel Server <= 26.8 (October 2026 CPU)	Nessus	Misc.	Local	high
463900	Echo: org.eclipse.jetty:jetty-server: security update to 12.0.35	Tenable Cloud Security	Echo Local Security Checks	Local	medium
463900	Echo: org.eclipse.jetty:jetty-server: security update to 12.0.35	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
445142	SCA: security update for org.eclipse.jetty:jetty-server (GHSA-7p3p-8qv8-m2vh)	Tenable Cloud Security	SCA Checks	Local	medium
445142	SCA: security update for org.eclipse.jetty:jetty-server (GHSA-7p3p-8qv8-m2vh)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
327135	Linux Distros Unpatched Vulnerability : CVE-2026-6790	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-6790

medium

Tenable Plugins

Coming Soon

high

medium

medium

medium

medium

medium