The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3964-1 advisory.

    - CVE-2025-53057: Fixed an issue where an unauthenticated attacker can achieve unauthorized creation,     deletion or modification access to critical data (bsc#1252414)
     - CVE-2025-53066: Fixed an issue where an unauthenticated attacker can achieve unauthorized access to     critical data or complete access (bsc#1252417)
     - CVE-2025-61748: Fixed an issue where an unauthenticated attacker can achieve unauthorized update,     insert or delete access to some resources (bsc#1252418)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2025:0174 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-53057:
    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and  21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation,     deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

    CVE-2025-53066:
    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and  21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to     critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise     Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:21485 advisory.

    * JDK: Enhance Path Factories (CVE-2025-53066)

    * JDK: Enhance Certificate Handling (CVE-2025-53057)

    * JDK: Enhance String Handling (CVE-2025-61748)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0744 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-53066:
    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and  21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to     critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise     Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

    CVE-2025-53057:
    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and  21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation,     deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20947-1 advisory.

    Changes in java-21-openj9:

    - Make post scripts less noisy (bsc#1267355)

    - Use libalternatives instead of update-alternatives for       distributions where libalternatives is available

    - Update to OpenJDK 21.0.11 with OpenJ9 0.59.0 virtual machine
    - Including Oracle April 2026 CPU changes
      * CVE-2026-22007 (bsc#1262490), CVE-2026-22013 (bsc#1262494),         CVE-2026-22016 (bsc#1262495), CVE-2026-22018 (bsc#1262496),         CVE-2026-22021 (bsc#1262497), CVE-2026-23865 (bsc#1259118),         CVE-2026-34268 (bsc#1262500), CVE-2026-34282 (bsc#1262501)
    - OpenJ9 specific security fix
      * CVE-2026-1188 (bsc#1265261)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.59/

    - Update to OpenJDK 21.0.10 with OpenJ9 0.57.0 virtual machine
    - Including Oracle January 2026 CPU changes
      * CVE-2026-21925 (bsc#1257034), CVE-2026-21932 (bsc#1257036),         CVE-2026-21933 (bsc#1257037), CVE-2026-21945 (bsc#1257038)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.57/

    - Do not depend on update-desktop-files (jsc#PED-14507)

    - Update to OpenJDK 21.0.9 with OpenJ9 0.56.0 virtual machine
    - Including Oracle October 2025 CPU changes
      * CVE-2025-53057 (bsc#1252414), CVE-2025-53066 (bsc#1252417),         CVE-2025-61748 (bsc#1252418)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.56/

    - Update to OpenJDK 21.0.8 with OpenJ9 0.53.0 virtual machine
    - Including Oracle July 2025 CPU changes
      * CVE-2025-30749 (bsc#1246595), CVE-2025-30754 (bsc#1246598),         CVE-2025-50059 (bsc#1246575), CVE-2025-50106 (bsc#1246584)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.53/
    - Enable bootcycle build

    - Do not embed rebuild counter (bsc#1246806)

    - Add -std=gnu99 to CFLAGS to fix gcc15 compile time error. Since       the C++ part is on -std=gnu++98, this is the closest.

    - Update to OpenJDK 21.0.7 with OpenJ9 0.51.0 virtual machine
    - Including Oracle April 2025 CPU changes
      * CVE-2025-21587 (bsc#1241274), CVE-2025-30691 (bsc#1241275),         CVE-2025-30698 (bsc#1241276)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.51/

    - fix wrong execstack flag in libj9jit (bsc#1235844)

    - Update to OpenJDK 21.0.6 with OpenJ9 0.49.0 virtual machine
    - Including Oracle October 2024 and January 2025 CPU changes
      * CVE-2024-21208 (bsc#1231702), CVE-2024-21210 (bsc#1231711),         CVE-2024-21217 (bsc#1231716), CVE-2024-21235 (bsc#1231719),         CVE-2025-21502 (bsc#1236278)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.49/

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
274421	SUSE SLES12: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-devel / etc (SUSE-SU-2025:3964-1)	Nessus	SuSE Local Security Checks	11/7/2025	6/25/2026	high
275556	Alibaba Cloud Linux 3 : 0174: java-1.8.0-openjdk (ALINUX3-SA-2025:0174)	Nessus	Alibaba Cloud Linux Local Security Checks	11/17/2025	11/17/2025	high
276736	RockyLinux 10 : java-25-openjdk (RLSA-2025:21485)	Nessus	Rocky Linux Local Security Checks	11/25/2025	11/25/2025	high
330775	TencentOS Server 4: java-8-konajdk (TSSA-2026:0744)	Nessus	Tencent Local Security Checks	7/29/2026	7/29/2026	high
321009	openSUSE 16 Security Update : java-21-openj9 (openSUSE-SU-2026:20947-1)	Nessus	SuSE Local Security Checks	6/14/2026	6/14/2026	medium

Detections

Analytics

Plugins Search

high

high

high

high

medium