It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1684 advisory.

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows     unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read     access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible     data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a     web service which supplies data to the APIs. This vulnerability also applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts).  CVSS Vector:
    (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). (CVE-2026-22007)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JGSS).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized     access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted     code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). (CVE-2026-22013)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs     in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). (CVE-2026-22016)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2026-22018)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for     JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM     for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2026-22021)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and     21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows     unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read     access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible     data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a     web service which supplies data to the APIs. This vulnerability also applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts).  CVSS Vector:
    (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). (CVE-2026-34268)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE:
    8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and  21.0.10; Oracle     GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). (CVE-2026-34282)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1703-1 advisory.

    Upgrade to upstream tag jdk-11.0.31+11 (April 2026 CPU).

    Security issues fixed:

    - CVE-2026-22007: Security: unauthenticated attacker with logon to the infrastructure where java executes     can gain       unauthorized read access to a subset of accessible data (bsc#1262490).
    - CVE-2026-22013: JGSS: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       access to critical data (bsc#1262494).
    - CVE-2026-22016: JAXP: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       to access critical data (bsc#1262495).
    - CVE-2026-22018: Libraries: unauthenticated attacker with network access via multiple protocols can cause     a partial       denial of service (bsc#1262496).
    - CVE-2026-22021: JSSE: unauthenticated attacker with network access via HTTPS can cause a partial denial     of service       (bsc#1262497).
    - CVE-2026-23865: freetype2: integer overflow in the `tt_var_load_item_variation_store` function allows     for an       out-of-bounds read when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts(bsc#1259118).
    - CVE-2026-34268: Security: unauthenticated attacker with logon to the infrastructure where java executes     can gain       unauthorized read access to a subset of data (bsc#1262500).
    - CVE-2026-34282: Networking: unauthenticated attacker with network access via multiple protocols can     cause a hang or       frequently repeatable crash (bsc#1262501).

    Other updates and bugfixes:

    - Provide the timezone-java and tzdata-java (jsc#PED-15898).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1705-1 advisory.

    Update to upstream tag jdk-21.0.11+10 (April 2026 CPU).

    Security issues fixed:

    - CVE-2026-22007: Security: unauthenticated attacker with logon to the infrastructure where java executes     can gain       unauthorized read access to a subset of accessible data (bsc#1262490).
    - CVE-2026-22013: JGSS: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       access to critical data (bsc#1262494).
    - CVE-2026-22016: JAXP: unauthenticated attacker with network access via multiple protocols can gain     unauthorized       to access critical data (bsc#1262495).
    - CVE-2026-22018: Libraries: unauthenticated attacker with network access via multiple protocols can cause     a partial       denial of service (bsc#1262496).
    - CVE-2026-22021: JSSE: unauthenticated attacker with network access via HTTPS can cause a partial denial     of service       (bsc#1262497).
    - CVE-2026-23865: freetype2: integer overflow in the `tt_var_load_item_variation_store` function allows     for an       out-of-bounds read when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts(bsc#1259118).
    - CVE-2026-34268: Security: unauthenticated attacker with logon to the infrastructure where java executes     can gain       unauthorized read access to a subset of data (bsc#1262500).
    - CVE-2026-34282: Networking: unauthenticated attacker with network access via multiple protocols can     cause a hang or       frequently repeatable crash (bsc#1262501).

    Other updates and bugfixes:

    - Provide the timezone-java and tzdata-java (jsc#PED-15898).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
313516	Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2026-1684)	Nessus	Amazon Linux Local Security Checks	5/9/2026	5/9/2026	high
313650	SUSE SLES12 Security Update : java-11-openjdk (SUSE-SU-2026:1703-1)	Nessus	SuSE Local Security Checks	5/10/2026	5/10/2026	high
313672	SUSE SLED15 / SLES15 Security Update : java-21-openjdk (SUSE-SU-2026:1705-1)	Nessus	SuSE Local Security Checks	5/10/2026	5/10/2026	high

Detections

Analytics

Plugins Search

high

high

high