The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20611-1 advisory.

    - CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
    - CVE-2026-25854: Occasionally open redirect (bsc#1261851).
    - CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
    - CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
    - CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
    - CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
    - CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token     (bsc#1261856).
    - CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
    - CVE-2026-32990: The fix for CVE-2025-66614 was incomplete. (bsc#1258371)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1604-1 advisory.

    Security fixes:

    - CVE-2026-24880: Request smuggling via invalid chunk extension (bsc#1261850).
    - CVE-2026-25854: Occasionally open redirect (bsc#1261851).
    - CVE-2026-29129: TLS cipher order is not preserved (bsc#1261852).
    - CVE-2026-29145: OCSP checks sometimes soft-fail even when soft-fail is disabled (bsc#1261853).
    - CVE-2026-29146,CVE-2026-34486: Fix for allowed bypass of EncryptInterceptor (bsc#1261854).
    - CVE-2026-34483: Incomplete escaping of JSON access logs (bsc#1261855).
    - CVE-2026-34487: Cloud membership for clustering component exposed the Kubernetes bearer token     (bsc#1261856).
    - CVE-2026-34500: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (bsc#1261857).
    - CVE-2026-32990: The fix for CVE-2025-66614 was incomplete, so this CVE completes it (bsc#1258371).

    Other fixes:

    - Update to Tomcat 9.0.117

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36878 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in     EncryptInterceptor (CVE-2026-29146)

    * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass     (CVE-2026-34486)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-36879 advisory.

    [1:9.0.117-2]
    - Resolves: RHEL-183992 Remove tomcat clustering JAR from RPM builds
    - Exclude i686 architecture from build

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:36879 advisory.

    * Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in     EncryptInterceptor (CVE-2026-29146)
      * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass     (CVE-2026-34486)


    Bug Fix(es) and Enhancement(s):

      * Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-183992)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-37137 advisory.

    [1:9.0.87-2]
    - Resolves: RHEL-183993 Remove tomcat clustering JAR from RPM builds

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
310085	openSUSE 16 Security Update : tomcat (openSUSE-SU-2026:20611-1)	Nessus	SuSE Local Security Checks	4/24/2026	8/4/2026	high
310238	SUSE SLES15 Security Update : tomcat (SUSE-SU-2026:1604-1)	Nessus	SuSE Local Security Checks	4/25/2026	8/4/2026	high
325801	RHEL 9 : tomcat (RHSA-2026:36878)	Nessus	Red Hat Local Security Checks	7/9/2026	8/4/2026	high
325926	Oracle Linux 9 : tomcat (ELSA-2026-36879)	Nessus	Oracle Linux Local Security Checks	7/9/2026	8/4/2026	high
326053	AlmaLinux 9 : tomcat (ALSA-2026:36879)	Nessus	Alma Linux Local Security Checks	7/9/2026	8/4/2026	high
326091	Oracle Linux 8 : tomcat (ELSA-2026-37137)	Nessus	Oracle Linux Local Security Checks	7/10/2026	8/4/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high