The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Addressing certain issues, in particular related to operations which may take excessively long and     therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim)     are commonly available, the decision was to deprecate the functionality, while still retaining it for     people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run.
    (CVE-2026-42493)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3423-1 advisory.

    This update for xen fixes the following issues

    - CVE-2026-42493: x86 shadow paging is deprecated (bsc#1271528).
    - CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in     libfsimage iso9660 handling (bsc#1271530).
    - CVE-2026-62426,CVE-2026-62427: sysctl and platform-op locks open to abuse (bsc#1271531).
    - CVE-2026-62428: grant-table: type confusion in grant-copy (bsc#1271532).
    - CVE-2026-62429: vNUMA domain cleanup may race other operations (bsc#1271534).
    - CVE-2026-62430: x86: Out-of-bounds read in vRTC emulation (bsc#1271535).
    - CVE-2026-62431: Viridian STIMER division by zero (bsc#1271536).
    - CVE-2026-62432: evtchn: Race between FIFO expand and reset (bsc#1271537).
    - CVE-2026-62433: correct buffer checks for DM_OP hypercalls (bsc#1271538).
    - CVE-2026-62434: PoD: Don't try to reclaim special pages (bsc#1271539).
    - pygrub is only supported in de-privileged mode (XSA-508) (bsc#1271947).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3409-1 advisory.

    This update for xen fixes the following issues

    - CVE-2026-42493: x86 shadow paging is deprecated (bsc#1271528).
    - CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in     libfsimage iso9660 handling (bsc#1271530).
    - CVE-2026-62426,CVE-2026-62427: sysctl and platform-op locks open to abuse (bsc#1271531).
    - CVE-2026-62428: grant-table: type confusion in grant-copy (bsc#1271532).
    - CVE-2026-62429: vNUMA domain cleanup may race other operations (bsc#1271534).
    - CVE-2026-62430: x86: Out-of-bounds read in vRTC emulation (bsc#1271535).
    - CVE-2026-62431: Viridian STIMER division by zero (bsc#1271536).
    - CVE-2026-62432: evtchn: Race between FIFO expand and reset (bsc#1271537).
    - CVE-2026-62433: correct buffer checks for DM_OP hypercalls (bsc#1271538).
    - CVE-2026-62434: PoD: Don't try to reclaim special pages (bsc#1271539).
    - pygrub is only supported in de-privileged mode (XSA-508) (bsc#1271947).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bf1da84dfc advisory.

    update to xen 4.21.2     includes security fixes     x86 shadow paging is deprecated [XSA-495, CVE-2026-42493]     vIRQ event channel binding may break Xenstore [XSA-496, CVE-2026-42492]     buffer overruns in libfsimage iso9660 handling [XSA-497, CVE-2026-42494,     CVE-2026-42495, CVE-2026-62423, CVE-2026-62424, CVE-2026-62425]     sysctl and platform-op locks open to abuse [XSA-499, CVE-2026-62426,     CVE-2026-62427]     grant-table: type confusion in grant-copy [XSA-500, CVE-2026-62428]     grant-table: version change racing with other operations [XSA-501,     CVE-2026-62435, CVE-2026-62436]     vNUMA domain cleanup may race other operations [XSA-502, CVE-2026-62429]     x86: Out-of-bounds read in vRTC emulation [XSA-503, CVE-2026-62430]     Viridian STIMER division by zero [XSA-504, CVE-2026-62431]     evtchn: Race between FIFO expand and reset [XSA-505, CVE-2026-62432]     correct buffer checks for DM_OP hypercalls [XSA-506, CVE-2026-62433]     PoD: Don't try to reclaim special pages [XSA-507, CVE-2026-62434]     pygrub is only supported in de-privileged mode [XSA-508]

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
330590	Linux Distros Unpatched Vulnerability : CVE-2026-42493	Nessus	Misc.	7/29/2026	7/29/2026	high
331431	SUSE SLES15: xen / xen-devel / xen-libs / xen-tools / xen-tools-domU / etc (SUSE-SU-2026:3423-1)	Nessus	SuSE Local Security Checks	7/31/2026	7/31/2026	high
331456	SUSE SLES15: xen / xen-devel / xen-libs / xen-tools / xen-tools-domU / etc (SUSE-SU-2026:3409-1)	Nessus	SuSE Local Security Checks	7/31/2026	7/31/2026	high
331597	Fedora 44 : xen (2026-bf1da84dfc)	Nessus	Fedora Local Security Checks	8/2/2026	8/2/2026	high

Detections

Analytics

Plugins Search

high

high

high

high