The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory.

  - Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud     Manager). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the     vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products     (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud     Applications. (CVE-2026-101446)

  - Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI (Ruby)).
    Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful     attacks of this vulnerability can result in takeover of Siebel CRM End User. (CVE-2026-54906)

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface     (Apache Tomcat)). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification     access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to     critical data or complete access to all Siebel CRM Deployment accessible data. (CVE-2026-24733,     CVE-2026-41284, CVE-2026-43513, CVE-2026-43515, CVE-2026-59083)

  - Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing).
    Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged     attacker with network access via SQL to compromise Siebel Apps - Life Sciences. Successful attacks of this     vulnerability can result in takeover of Siebel Apps - Life Sciences. (CVE-2026-101457)

  - Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval     Manager). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development. Successful     attacks require human interaction from a person other than the attacker. Successful attacks of this     vulnerability can result in takeover of Siebel CRM Development. (CVE-2026-101495)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data     Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1,     UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls     prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property     annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged     active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1. (CVE-2026-59889)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70229 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss  Enterprise Application Platform 8.1.8 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 8.1.7, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.8 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser [eap-8.1.z]     (CVE-2026-68494)

    * netty-codec-http2: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [eap-8.1.z]     (CVE-2026-56745)

    * netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration     [eap-8.1.z] (CVE-2026-62243)

    * bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute     subpacket length [eap-8.1.z] (CVE-2026-59649)

    * jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified [eap-8.1.z]     (CVE-2026-54515)

    * jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped     properties [eap-8.1.z] (CVE-2026-59889)

    * netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain     Names [eap-8.1.z] (CVE-2026-73508)

    * jboss-eap.1-runtime-maven-repository.zip: jackson-core: Denial of Service via incomplete fix in async     JSON parser [eap-8.1.z] (CVE-2026-68494)

    * jboss-eap-runtime-maven-repository.zip: jackson-core: Denial of Service via incomplete fix in async JSON     parser [eap-8.1.z] (CVE-2026-68494)

    * bcprov-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion [eap-8.1.z]     (CVE-2026-3505)

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays [eap-8.1.z]     (CVE-2026-69152)

    * netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) [eap-8.1.z]     (CVE-2026-59899)

    * netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header     [eap-8.1.z] (CVE-2026-56746)

    * netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [eap-8.1.z]     (CVE-2026-56745)

    * netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing [eap-8.1.z]     (CVE-2026-55831)

    * netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification [eap-8.1.z]     (CVE-2026-55833)

    * jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution [eap-8.1.z]     (CVE-2026-54513)

    * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass     [eap-8.1.z] (CVE-2026-54512)

    * undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap [eap-8.1.z]     (CVE-2026-14180)

    * artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0     [eap-8.1.z] (CVE-2026-49363)

    * undertow-websockets-jsr: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with     any @OnMessage method [eap-8.1.z] (CVE-2026-15565)

    * wildfly-iiop-openjdk: Wildfly: Pre-auth denial of service on the IIOP listener [eap-8.1.z]     (CVE-2026-15567)

    * cxf-rt-transports-jms: Apache CXF: Arbitrary code execution via untrusted JMS configuration [eap-8.1.z]     (CVE-2026-50632)

    * cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing     JAXP hardening [eap-8.1.z] (CVE-2026-49875)

    * wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER     Payload [eap-8.1.z] (CVE-2026-10832)

    * cxf-rt-transports-jms: Apache CXF: Remote Code Execution via untrusted JMS configuration [eap-8.1.z]     (CVE-2026-44417)

    * wildfly-elytron-realm-token: parameter injection in EAP's elytron oauth2 [eap-8.1.z] (CVE-2026-85511)

    * jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include     [eap-8.1.z] (CVE-2026-46581)

    * wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS [eap-8.1.z]     (CVE-2026-15563)

    * jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of     service [eap-8.1.z] (CVE-2026-15562)

    * undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow [eap-8.1.z] (CVE-2026-15561)

    * openjdk-orb: unauthed class loading via IIOP in EAP [eap-8.1.z] (CVE-2026-15560)

    * artemis-server: Apache Artemis  session hijack via missing authentication [eap-8.1.z]     (CVE-2026-57967)

    * wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller     [eap-8.1.z] (CVE-2026-15555)

    * undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery [eap-8.1.z]     (CVE-2026-15554)

    * jgroups: artemis cluster password leak via jgroups spoof [eap-8.1.z] (CVE-2026-49364)

    * artemis-server: artemis core protocol permits unauthed queue creation [eap-8.1.z] (CVE-2026-49362)

    * artemis-server: artemis messaging handlers in Red Hat EAP permit deserialization by default [eap-8.1.z]     (CVE-2026-86404)

    * undertow-core: Undertow: Denial of Service via WebSocket permessage-deflate processing [eap-8.1.z]     (CVE-2026-5680)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a28dd61b-be3e-11f1-bd34-3c7c3fba4204 advisory.

    The Keycloak Team reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3273-1 advisory.

    - CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of       @JsonIgnoreProperties exclusions (bsc#1268902).
    - CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized     writes to       @JsonView restricted fields (bsc#1271440).
    - CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a     bypass of       @JsonIgnore restrictions (bsc#1271442).

    Changes for jackson-annotations:

    - Update to 2.18.9.

    Changes for jackson-bom:

    - Update to 2.18.9.

    Changes for jackson-core:

    - Update to 2.18.9.

    Changes for jackson-databind:

    - Update to 2.18.9:

     * honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).

    Changes for jackson-dataformats-binary:

    - Update to 2.18.9.

    Changes for jackson-modules-base:

    - Update to 2.18.9.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 13.5.0.0 and 24.1.0.0 versions of Enterprise Manager Cloud Control installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory.

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Oracle Management Service (Apache Commons BeanUtils)). Supported versions that are affected     are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via     HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can     result in takeover of Oracle Enterprise Manager Base Platform. (CVE-2025-48734)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise     Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle     Enterprise Manager Base Platform. (CVE-2026-101518)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Security Framework (jackson-databind)). Supported versions that are affected are 13.5 and     24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in     takeover of Oracle Enterprise Manager Base Platform. (CVE-2026-54512, CVE-2026-54513)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
370447	Oracle Siebel Server <= 26.8 (October 2026 CPU)	Nessus	Misc.	2026/10/22	2026/10/26	high
327170	Linux Distros Unpatched Vulnerability : CVE-2026-59889	Nessus	Misc.	2026/7/16	2026/11/6	medium
348793	RHEL 9 : Red Hat JBoss Enterprise Application Platform 8.1.8 (RHSA-2026:70229)	Nessus	Red Hat Local Security Checks	2026/9/22	2026/9/30	high
362708	FreeBSD : Keycloak -- multiple vulnerabilities (a28dd61b-be3e-11f1-bd34-3c7c3fba4204)	Nessus	FreeBSD Local Security Checks	2026/10/2	2026/10/2	high
330284	SUSE SLED15: jackson-annotations / jackson-core / jackson-databind / etc (SUSE-SU-2026:3273-1)	Nessus	SuSE Local Security Checks	2026/7/28	2026/7/28	medium
370430	Oracle Enterprise Manager Cloud Control (October 2026 CPU)	Nessus	Misc.	2026/10/22	2026/11/10	high

检测

插件搜索

high

medium

high

high

medium

high