The version of Java installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.
  - Vulnerability in Oracle Java SE (component: JavaFX (libxslt)). Supported versions that are affected are     Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of     Oracle Java SE. (CVE-2025-7425)

  - Vulnerability in Oracle Java SE (component: JavaFX (WebKitGTK)). Supported versions that are affected are     Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of     Oracle Java SE. (CVE-2025-43368)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471,     8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle     GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a     hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. (CVE-2026-21945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Java SE Multiple Vulnerabilities (January 2026 CPU)

medium Nessus Plugin ID 294870

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Feb 4, 2026, 2:23 PM CVSS metrics ("CVSSv3 score" set to 7.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H") CVSS metrics ("Cvssv4 score" set to 4.8) CVSS metrics ("Cvssv4 threat score" set to 1.9) CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:P") CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv3 score source (changed from "CVE-2025-7425" to "CVE-2025-6052") CVSSv4 severity (based on CVE-2025-8732, severity decreased from "High" to "Medium") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" set to "Exploits are available") Plugin Feed: 202602041423
Version 1.2 Jan 26, 2026, 9:17 PM New Plugin Feed: 202601262117
Version 1.1 Jan 21, 2026, 8:52 PM New Plugin Feed: 202601212052