The version of OpenJDK installed on the remote host is 8 prior to 8u492 / 11.0.0 prior to 11.0.31 / 17.0.0 prior to 17.0.19 / 21.0.0 prior to 21.0.11 / 25.0.0 prior to 25.0.3 / 26.0.0 prior to 26.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026-07-21 advisory.

Please Note: Java CVEs do not always include OpenJDK versions, but are confirmed separately by Tenable using the patch versions from the referenced OpenJDK security advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491,     8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle     GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2026-47063)

  - Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check     is performed after the multiplication. (CVE-2026-41254)

  - Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle     Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. (CVE-2026-47057)

  - Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle     Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this     vulnerability can result in unauthorized creation, deletion or modification access to critical data or all     Oracle Java SE accessible data as well as unauthorized access to critical data or complete access to all     Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. (CVE-2026-47058)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u491,     8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle     GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs     in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. (CVE-2026-60147)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

OpenJDK 8 <= 8u492 / 11.0.0 <= 11.0.31 / 17.0.0 <= 17.0.19 / 21.0.0 <= 21.0.11 / 25.0.0 <= 25.0.3 / 26.0.0 <= 26.0.1 Multiple Vulnerabilities (2026-07-21)

high Nessus Plugin ID 329174

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Jul 27, 2026, 10:22 AM Plugin metadata (Add IAVM Info) Plugin Feed: 202607271022
Version 1.2 Jul 24, 2026, 11:07 AM CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C") CVSSv2 score source (changed from "CVE-2026-47063" to "CVE-2026-41254") CVSSv3 score source (changed from "CVE-2026-41254" to none) Plugin Feed: 202607241107
Version 1.1 Jul 23, 2026, 1:28 PM New Plugin Feed: 202607231328