The 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 and 27 releases of Oracle Java SE installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory.

  - Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX     (WebKitGTK)). Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4     and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Oracle Java SE, Oracle JavaFX. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle     Java SE, Oracle JavaFX. (CVE-2026-43660)

  - Vulnerability in Oracle Java SE (component: Java plugin). Supported versions that are affected are Oracle     Java SE: 8u503 and 8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon     to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. While the vulnerability is     in Oracle Java SE, attacks may significantly impact additional products (scope change). (CVE-2026-91484)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf,     11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle     GraalVM Enterprise Edition: 21.3.19.1.1. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for     JDK, Oracle GraalVM Enterprise Edition as well as unauthorized update, insert or delete access to some of     Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized     read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. (CVE-2026-91415)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle     Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u503; Oracle     JavaFX: 21.0.12, 25.0.4 and 27; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle Java SE, Oracle JavaFX, Oracle GraalVM     Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE,     Oracle JavaFX, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. This vulnerability does not apply to Java deployments, typically in servers, that load and     run only trusted code (e.g., code installed by an administrator). (CVE-2026-91385)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
372932	Oracle Java SE Multiple Vulnerabilities (October 2026 CPU)	Nessus	Misc.	10/28/2026	10/29/2026	medium
370258	Linux Distros Unpatched Vulnerability : CVE-2026-91385	Nessus	Misc.	10/22/2026	10/30/2026	medium

Detections

Analytics

Plugins Search

medium

medium