The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle     Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result     in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2026-22008)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-9693 advisory.

    [1:25.0.3.0.9-1.0.1]
    - Add Oracle vendor bug URL [Orabug: 34340155]

    [1:25.0.3.0.9-1]
    - Update to jdk-25.0.3+9 (GA)
    - Update release notes to 25.0.3+9
    - Update FIPS patch to 57722aab802 version synced with 25.0.3+8
    - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream
    - Drop local HarfBuzz patch now JDK-8375057 is included upstream
    - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
    - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
    - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047
    - Bump zlib version to 1.3.2 following JDK-8378631
    - Bump tzdata version to 2026a following JDK-8379035
    - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4
    - Sync the copy of the portable specfile with the latest update
    - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
    - Resolves: RHEL-169620
    - Resolves: RHEL-157091
    - Resolves: RHEL-161217
    - Resolves: RHEL-161333
    - Resolves: RHEL-169613

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:9693 advisory.

    * JDK: Enhance crypto algorithm support (CVE-2026-22007)
      * JDK: Improved Arena allocations (CVE-2026-22008)
      * JDK: Improve Kerberos credentialing (CVE-2026-22013)
      * JDK: Enhance Path Factories Redux (CVE-2026-22016)
      * JDK: Enhance Zip file reading (CVE-2026-22018)
      * JDK: Enhance certificate chain validation (CVE-2026-22021)
      * JDK: Updating FreeType 2.14.1 (CVE-2026-23865)
      * JDK: Enhance TLS connection handling (CVE-2026-34282)
      * JDK: Enhance key generation (CVE-2026-34268)


    This release also updates a number of third-party libraries included in the JDK. The libraries themselves     are affected by the following CVEs, but this is not a statement that the JDK itself is affected:

      * giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)
      * libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette     expansion (CVE-2026-33636)
      * libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)


    Bug Fix(es):

      * When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance     reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 25 releases, a     response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is     rectified in this release. (AlmaLinux-169939, AlmaLinux-169937)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9693 advisory.

    The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software     Development Kit.

    Security Fix(es):

    * JDK: Enhance crypto algorithm support (CVE-2026-22007)

    * JDK: Improved Arena allocations (CVE-2026-22008)

    * JDK: Improve Kerberos credentialing (CVE-2026-22013)

    * JDK: Enhance Path Factories Redux (CVE-2026-22016)

    * JDK: Enhance Zip file reading (CVE-2026-22018)

    * JDK: Enhance certificate chain validation (CVE-2026-22021)

    * JDK: Updating FreeType 2.14.1 (CVE-2026-23865)

    * JDK: Enhance TLS connection handling (CVE-2026-34282)

    * JDK: Enhance key generation (CVE-2026-34268)

    This release also updates a number of third-party libraries included in the JDK.  The libraries themselves     are affected by the following CVEs, but this is not a statement that the JDK itself is affected:

    * giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)

    * libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette     expansion (CVE-2026-33636)

    * libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

    Bug Fix(es):

    * When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance     reasons, only falling back to sendfile when this fails.  However, in previous OpenJDK 25 releases, a     response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile.  This is     rectified in this release. (RHEL-169939, RHEL-169937)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenJDK installed on the remote host is 8 prior to 8u482 / 11.0.0 prior to 11.0.30 / 17.0.0 prior to 17.0.18 / 21.0.0 prior to 21.0.10 / 25.0.0 prior to 25.0.2 / 26.0.0 prior to 26.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026-04-21 advisory.

Please Note: Java CVEs do not always include OpenJDK versions, but are confirmed separately by Tenable using the patch versions from the referenced OpenJDK security advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2026-22016)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE:
    8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle     GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a     hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. (CVE-2026-34282)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2026-22021)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than     the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data     or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2026-22013)

  - An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions     2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in     OpenType variable fonts. This issue is fixed in version 2.14.2. (CVE-2026-23865)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Java installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet)     and rely on the Java sandbox for security. (CVE-2026-22016)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf,     11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise     Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via     multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
    Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web     service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted     code (e.g., code that comes from the internet) and rely on the Java sandbox for security. (CVE-2026-34282)

  - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and     iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A remote attacker may be able to     cause a denial-of-service. (CVE-2026-20652)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Azul Zulu installed on the remote host is 6 prior to 6.79.0.14 / 7 prior to 7.85.0.12 / 8 prior to 8.93.0.18 / 11 prior to 11.87.18 / 17 prior to 17.65.18 / 21 prior to 21.49.18 / 25 prior to 25.33.16 / 26 prior to 26.30.12. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026-04-21 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2026-22016)

  - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and     iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A remote attacker may be able to     cause a denial-of-service. (CVE-2026-20652)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated     attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note:
    This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service     which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code     (e.g., code that comes from the internet) and rely on the Java sandbox for security. (CVE-2026-22007,     CVE-2026-34268)

  - Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle     Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result     in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2026-22008)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u481,     8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10;
    Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than     the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data     or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2026-22013)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
309648	Linux Distros Unpatched Vulnerability : CVE-2026-22008	Nessus	Misc.	4/22/2026	4/29/2026	low
310026	Oracle Linux 10 / 9 : java-25-openjdk (ELSA-2026-9693)	Nessus	Oracle Linux Local Security Checks	4/23/2026	4/23/2026	high
310149	AlmaLinux 10 : java-25-openjdk (ALSA-2026:9693)	Nessus	Alma Linux Local Security Checks	4/24/2026	4/24/2026	high
309745	RHEL 10 / 9 : java-25-openjdk (RHSA-2026:9693)	Nessus	Red Hat Local Security Checks	4/22/2026	4/22/2026	high
310406	OpenJDK 8 <= 8u482 / 11.0.0 <= 11.0.30 / 17.0.0 <= 17.0.18 / 21.0.0 <= 21.0.10 / 25.0.0 <= 25.0.2 / 26.0.0 <= 26.0.0 Multiple Vulnerabilities (2026-04-21)	Nessus	Misc.	4/27/2026	4/27/2026	high
309197	Oracle Java SE Multiple Vulnerabilities (April 2026 CPU)	Nessus	Misc.	4/22/2026	4/24/2026	high
309082	Azul Zulu Java Multiple Vulnerabilities (2026-04-21)	Nessus	Misc.	4/21/2026	4/23/2026	high

Detections

Analytics

Plugins Search

low

high

high

high

high

high

high