The version of AOS installed on the remote host is prior to 7.3.1.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.3.1.2 advisory.

  - A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic     within the certtool utility. When it reads certain settings from a template file, it allows an attacker to     cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service     (DoS) that could potentially crash the system. (CVE-2025-32990)

  - Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in     Vim's tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation     can lead to overwriting sensitive files or placing executable code in privileged locations, depending on     the permissions of the process editing the archive. The victim must edit such a file using Vim which will     reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying     operating system. Version 9.1.1552 contains a patch for the vulnerability. (CVE-2025-53905)

  - Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in     Vim's zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation     can lead to overwriting sensitive files or placing executable code in privileged locations, depending on     the permissions of the process editing the archive. The victim must edit such a file using Vim which will     reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying     operating system. Version 9.1.1551 contains a patch for the vulnerability. (CVE-2025-53906)

  - A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle     attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how     OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be     considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning     the attack complexity high. (CVE-2025-26465)

  - Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was     introduced which means that the entire temporary file is read into memory and then logged. An attacker     might be able to exploit this to cause a denial of service attack by causing an out of memory exception.
    In addition, it is possible to configure CXF to encrypt temporary files to prevent sensitive credentials     from being cached unencrypted on the local filesystem, however this bug means that the cached files are     written out to logs unencrypted. Users are recommended to upgrade to versions 3.5.11, 3.6.6, 4.0.7 or     4.1.1, which fixes this issue. (CVE-2025-48795)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the cups-2.3.3op2-35.el9 build changelog.

  - Authentication Bypass in CUPS Authorization Handling (CVE-2025-58060)

  - Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS (CVE-2025-58364)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17144 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar     operating systems.

    Security Fix(es):

    * cups: Authentication Bypass in CUPS Authorization Handling (CVE-2025-58060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:15702 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for     Linux, UNIX, and similar operating systems.

    Security Fix(es):

    * cups: Authentication Bypass in CUPS Authorization Handling (CVE-2025-58060)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:17054 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar     operating systems.

    Security Fix(es):

    * cups: Authentication Bypass in CUPS Authorization Handling (CVE-2025-58060)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7745-1 advisory.

    It was discovered that CUPS incorrectly handled authentication types other than Basic. An attacker could     possibly use this issue to bypass authentication. (CVE-2025-58060)

    It was discovered that CUPS incorrectly handled deserialization and validation of printer attributes. An     attacker could possibly use this issue to cause a denial of service. (CVE-2025-58364)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987453 advisory.

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In     versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains     an `Authorization: Basic ...` header, the password is not checked. This results in authentication bypass.
    Any configuration that allows an `AuthType` that is not `Basic` is affected. Version 2.4.13 fixes the     issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5998 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5998-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     September 11, 2025                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : cups     CVE ID         : CVE-2025-58060 CVE-2025-58364

    Two vulnerabilities were discovered in cups, the Common UNIX Printing     System, which may result in authentication bypass with AuthType     Negotiate or in denial of service (daemon crash).

    For the oldstable distribution (bookworm), these problems have been fixed     in version 2.4.2-3+deb12u9.

    For the stable distribution (trixie), these problems have been fixed in     version 2.4.10-3+deb13u1.

    We recommend that you upgrade your cups packages.

    For the detailed security status of cups please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/cups

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20172-1 advisory.

    Update to version 2.4.16.

    Security issues fixed:

    - CVE-2025-61915: local denial-of-service via cupsd.conf update and related issues (bsc#1253783).
    - CVE-2025-58436: slow client communication leads to a possible DoS attack (bsc#1244057).
    - CVE-2025-58364: unsafe deserialization and validation of printer attributes can cause a null dereference     (bsc#1249128).
    - CVE-2025-58060: authentication bypass with AuthType Negotiate (bsc#1249049).

    Other updates and bugfixes:

    - Version upgrade to 2.4.16:

      * 'cupsUTF8ToCharset' didn't validate 2-byte UTF-8 sequences,         potentially reading past the end of the source string         (Issue #1438)
      * The web interface did not support domain usernames fully         (Issue #1441)
      * Fixed an infinite loop issue in the GTK+ print dialog         (Issue #1439 boo#1254353)
      * Fixed stopping scheduler on unknown directive in         configuration (Issue #1443)
      * Fixed packages for Immutable Mode (jsc#PED-14775         from epic jsc#PED-14688)

    - Version upgrade to 2.4.15:

      * Fixed potential crash in 'cups-driverd' when there are         duplicate PPDs (Issue #1355)
      * Fixed error recovery when scanning for PPDs         in 'cups-driverd' (Issue #1416)

    - Version upgrade to 2.4.14.

    - Version upgrade to 2.4.13:

      * Added 'print-as-raster' printer and job attributes         for forcing rasterization (Issue #1282)
      * Updated documentation (Issue #1086)
      * Updated IPP backend to try a sanitized user name if the         printer/server does not like the value (Issue #1145)
      * Updated the scheduler to send the printer-added         or printer-modified events  whenever an IPP Everywhere PPD         is installed (Issue #1244)
      * Updated the scheduler to send the printer-modified event         whenever the system default printer is changed (Issue #1246)
      * Fixed a memory leak in 'httpClose' (Issue #1223)
      * Fixed missing commas in 'ippCreateRequestedArray'         (Issue #1234)
      * Fixed subscription issues in the scheduler and D-Bus notifier         (Issue #1235)
      * Fixed media-default reporting for custom sizes (Issue #1238)
      * Fixed support for IPP/PPD options with periods or underscores         (Issue #1249)
      * Fixed parsing of real numbers in PPD compiler source files         (Issue #1263)
      * Fixed scheduler freezing with zombie clients (Issue #1264)
      * Fixed support for the server name in the ErrorLog filename         (Issue #1277)
      * Fixed job cleanup after daemon restart (Issue #1315)
      * Fixed handling of buggy DYMO USB printer serial numbers        (Issue #1338)
      * Fixed unreachable block in IPP backend (Issue #1351)
      * Fixed memory leak in _cupsConvertOptions (Issue #1354)

    - Version upgrade to 2.4.12:

      * GnuTLS follows system crypto policies now (Issue #1105)
      * Added `NoSystem` SSLOptions value (Issue #1130)
      * Now we raise alert for certificate issues (Issue #1194)
      * Added Kyocera USB quirk (Issue #1198)
      * The scheduler now logs a job's debugging history         if the backend fails (Issue #1205)
      * Fixed a potential timing issue with `cupsEnumDests`         (Issue #1084)
      * Fixed a potential lost PPD condition in the scheduler         (Issue #1109)
      * Fixed a compressed file error handling bug (Issue #1070)
      * Fixed a bug in the make-and-model whitespace trimming         code (Issue #1096)
      * Fixed a removal of IPP Everywhere permanent queue         if installation failed (Issue #1102)
      * Fixed `ServerToken None` in scheduler (Issue #1111)
      * Fixed invalid IPP keyword values created from PPD         option names (Issue #1118)
      * Fixed handling of media and PageSize in the same         print request (Issue #1125)
      * Fixed client raster printing from macOS (Issue #1143)
      * Fixed the default User-Agent string.
      * Fixed a recursion issue in `ippReadIO`.
      * Fixed handling incorrect radix in `scan_ps()` (Issue #1188)
      * Fixed validation of dateTime values with time zones         more than UTC+11 (Issue #1201)
      * Fixed attributes returned by the Create-Xxx-Subscriptions         requests (Issue #1204)
      * Fixed `ippDateToTime` when using a non GMT/UTC timezone         (Issue #1208)
      * Fixed `job-completed` event notifications for jobs that are         cancelled before started (Issue #1209)
      * Fixed DNS-SD discovery with `ippfind` (Issue #1211)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
277073	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.3.1.2)	Nessus	Misc.	12/2/2025	5/27/2026	high
269726	CentOS 9 : cups-2.3.3op2-35.el9	Nessus	CentOS Local Security Checks	10/8/2025	10/8/2025	high
266341	RHEL 8 : cups (RHSA-2025:17144)	Nessus	Red Hat Local Security Checks	10/1/2025	10/1/2025	high
264560	RHEL 8 : cups (RHSA-2025:15702)	Nessus	Red Hat Local Security Checks	9/11/2025	9/11/2025	high
266301	RHEL 7 : cups (RHSA-2025:17054)	Nessus	Red Hat Local Security Checks	9/30/2025	9/30/2025	high
265088	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : CUPS vulnerabilities (USN-7745-1)	Nessus	Ubuntu Local Security Checks	9/16/2025	9/16/2025	high
269031	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: cups (UTSA-2025-987453)	Nessus	Unity Linux Local Security Checks	10/7/2025	10/10/2025	high
264575	Debian dsa-5998 : cups - security update	Nessus	Debian Local Security Checks	9/11/2025	9/11/2025	high
298240	openSUSE 16 Security Update : cups (openSUSE-SU-2026:20172-1)	Nessus	SuSE Local Security Checks	2/6/2026	2/6/2026	medium

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

medium