The 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2 versions of Java installed on the remote host are affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32,     17.0.20, 21.0.12, 25.0.4, 26.0.2. Easily exploitable vulnerability allows low privileged attacker with logon     to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. Successful attacks of this     vulnerability can result in takeover of Oracle Java SE. (CVE-2026-62574)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32,     17.0.20, 21.0.12, 25.0.4, 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with     network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise     Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial     denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise     Edition. (CVE-2026-70907)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u501,     11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise     Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or     complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible     data. (CVE-2026-61308)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Java SE Multiple Vulnerabilities (August 2026 CSPU)

high Nessus Plugin ID 338352

Version 1.2