The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67604 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java     applications based on the WildFly application runtime.

    This asynchronous patch is a security update for Red Hat JBoss Enterprise     Application Platform 7.4.

    Security Fix(es):

    * artemis-server: Apache Artemis  session hijack via missing authentication (CVE-2026-57967)

    * artemis-server: artemis core protocol permits unauthed queue creation (CVE-2026-49362)

    * jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped     properties (CVE-2026-59889)

    * jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified (CVE-2026-54515)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgements, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 / 8 / 9 : Red Hat JBoss Enterprise Application Platform 7.4.25 (RHSA-2026:67604)

critical Nessus Plugin ID 345911

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Sep 19, 2026, 6:50 AM CVE (set "CVE" coverage to "CVE-2026-49362,CVE-2026-49364,CVE-2026-54515,CVE-2026-57967,CVE-2026-59889") Plugin Feed: 202609190650
Version 1.2 Sep 18, 2026, 11:05 PM Plugin metadata (Add IAVM Info) Plugin Feed: 202609182305
Version 1.1 Sep 16, 2026, 12:20 AM New Plugin Feed: 202609160020