In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.

oracle CPUOct2026: MySQL Cluster >=9.7.0|<=9.7.4

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.38

oracle CPUOct2026: MySQL Cluster >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.50

oracle CPUOct2026: MySQL Cluster >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Server >=9.7.0|<=9.7.4

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory.

  - Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud     Manager). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the     vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products     (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud     Applications. (CVE-2026-101446)

  - Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI (Ruby)).
    Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful     attacks of this vulnerability can result in takeover of Siebel CRM End User. (CVE-2026-54906)

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface     (Apache Tomcat)). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification     access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to     critical data or complete access to all Siebel CRM Deployment accessible data. (CVE-2026-24733,     CVE-2026-41284, CVE-2026-43513, CVE-2026-43515, CVE-2026-59083)

  - Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing).
    Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged     attacker with network access via SQL to compromise Siebel Apps - Life Sciences. Successful attacks of this     vulnerability can result in takeover of Siebel Apps - Life Sciences. (CVE-2026-101457)

  - Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval     Manager). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development. Successful     attacks require human interaction from a person other than the attacker. Successful attacks of this     vulnerability can result in takeover of Siebel CRM Development. (CVE-2026-101495)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of:
    /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it
    will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are
    served). However, web applications that rely on resolved paths being provided by Jetty may be confused
    when receiving an unresolved path. (CVE-2026-8384)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of:
    /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it     will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are     served). However, web applications that rely on resolved paths being provided by Jetty may be confused     when receiving an unresolved path. (CVE-2026-8384)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
370447	Oracle Siebel Server <= 26.8 (October 2026 CPU)	Nessus	Misc.	Local	high
455494	Echo: org.eclipse.jetty:jetty-util: security update to 12.0.35	Tenable Cloud Security	Echo Local Security Checks	Local	medium
455494	Echo: org.eclipse.jetty:jetty-util: security update to 12.0.35	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
445183	SCA: security update for org.eclipse.jetty:jetty-util (GHSA-w7x5-g22v-xqhr)	Tenable Cloud Security	SCA Checks	Local	medium
445183	SCA: security update for org.eclipse.jetty:jetty-util (GHSA-w7x5-g22v-xqhr)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
327131	Linux Distros Unpatched Vulnerability : CVE-2026-8384	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-8384

medium

Tenable Plugins

Coming Soon

high

medium

medium

medium

medium

medium