Detections
Analytics
SUSE SLES15 Security Update : google-guest-agent (SUSE-SU-2026:2612-1)
high Nessus Plugin ID 322894
Synopsis
The remote SUSE host is missing one or more security updates.Description
The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2612-1 advisory.This update for google-guest-agent fixes the following issues
Security issues:
- CVE-2026-39821: Update golang.org/x/net/idna dependency (bsc#1266603).
- CVE-2026-39827: Update golang.org/x/crypto dependency (bsc#1266171).
- CVE-2026-39828: Update golang.org/x/crypto dependency (bsc#1266171).
- CVE-2026-39829: Update golang.org/x/crypto dependency (bsc#1266171).
- CVE-2026-39830: Update golang.org/x/crypto dependency (bsc#1266171).
- CVE-2026-39831: Update golang.org/x/crypto dependency (bsc#1266171).
- CVE-2026-39832: Update golang.org/x/crypto dependency (bsc#1266171).
- CVE-2026-39833: Update golang.org/x/crypto dependency (bsc#1266171).
- CVE-2026-39834: Update golang.org/x/crypto dependency (bsc#1266171).
- CVE-2026-39835: Update golang.org/x/crypto dependency (bsc#1266171).
- CVE-2026-42508: Update golang.org/x/crypto dependency (bsc#1266171).
- CVE-2026-46595: Update golang.org/x/crypto dependency (bsc#1266171).
- CVE-2026-46597: Update golang.org/x/crypto dependency (bsc#1266171).
- CVE-2026-46598: Update golang.org/x/crypto dependency (bsc#1266171).
- CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236533).
- CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (bsc#1234563).
- CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239334).
- CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253889).
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264).
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265762).
- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262926).
Tenable has extracted the preceding description block directly from the SUSE security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected google-guest-agent package.See Also
https://bugzilla.suse.com/1210938
https://bugzilla.suse.com/1234563
https://bugzilla.suse.com/1236533
https://bugzilla.suse.com/1239334
https://bugzilla.suse.com/1239944
https://bugzilla.suse.com/1243254
https://bugzilla.suse.com/1243505
https://bugzilla.suse.com/1245759
https://bugzilla.suse.com/1253889
https://bugzilla.suse.com/1257010
https://bugzilla.suse.com/1260264
https://bugzilla.suse.com/1262926
https://bugzilla.suse.com/1265762
https://bugzilla.suse.com/1266171
https://bugzilla.suse.com/1266603
https://lists.suse.com/pipermail/sle-updates/2026-June/047609.html
https://www.suse.com/security/cve/CVE-2023-45288
https://www.suse.com/security/cve/CVE-2024-45337
https://www.suse.com/security/cve/CVE-2025-22868
https://www.suse.com/security/cve/CVE-2025-22869
https://www.suse.com/security/cve/CVE-2025-58181
https://www.suse.com/security/cve/CVE-2026-33186
https://www.suse.com/security/cve/CVE-2026-33814
https://www.suse.com/security/cve/CVE-2026-34986
https://www.suse.com/security/cve/CVE-2026-39821
https://www.suse.com/security/cve/CVE-2026-39827
https://www.suse.com/security/cve/CVE-2026-39828
https://www.suse.com/security/cve/CVE-2026-39829
https://www.suse.com/security/cve/CVE-2026-39830
https://www.suse.com/security/cve/CVE-2026-39831
https://www.suse.com/security/cve/CVE-2026-39832
https://www.suse.com/security/cve/CVE-2026-39833
https://www.suse.com/security/cve/CVE-2026-39834
https://www.suse.com/security/cve/CVE-2026-39835
https://www.suse.com/security/cve/CVE-2026-42508
https://www.suse.com/security/cve/CVE-2026-46595
Plugin Details
Severity: High
ID: 322894
File Name: suse_SU-2026-2612-1.nasl
Version: 1.1
Type: Local
Agent: unix
Family: SuSE Local Security Checks
Published: 6/26/2026
Updated: 6/26/2026
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, tenable_cloud_security, tenable_self_hosted_container_security, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.3
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2026-33814
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:novell:suse_linux:google-guest-agent, cpe:/o:novell:suse_linux:15
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/24/2026
Vulnerability Publication Date: 4/3/2024
Reference Information
CVE: CVE-2023-45288, CVE-2024-45337, CVE-2025-22868, CVE-2025-22869, CVE-2025-58181, CVE-2026-33186, CVE-2026-33814, CVE-2026-34986, CVE-2026-39821, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598
SuSE: SUSE-SU-2026:2612-1