The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42887 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * JDK: Enhance TLS certificate handling (CVE-2026-46968)

    * JDK: Improve DTLS handshaking (CVE-2026-46917)

    * JDK: Enhance JPEG handling (CVE-2026-47010)

    * JDK: Enhance XBM image support (CVE-2026-47021)

    * JDK: Enhance Jar file processing (CVE-2026-47027)

    * JDK: Improve certification checking (CVE-2026-60147)

    * JDK: Enhance AWT ImagingLib (CVE-2026-47059)

    * JDK: Enhance Jar handling (CVE-2026-47063)

    * JDK: Update LCMS to 2.19 (CVE-2026-41254)

    Enhancement(s):

    * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball     available on the customer portal.  The single portable build has a release number ('p') and each RPM has     its own release number ('r').  However, the RPM naming only showed the RPM release number, while the     version output from the build showed the portable release number, making it unclear that they were     different numbers.  From this release onwards, a release field of the form 'p.r' is always used for RPMs     and the version output shows 'p'. (RHEL-212474, RHEL-212475, RHEL-212476, RHEL-212477, RHEL-212478,     RHEL-212479, RHEL-212480, RHEL-212481)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42895 advisory.

    The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software     Development Kit.

    Security Fix(es):

    * JDK: Enhance TLS certificate handling (CVE-2026-46968)

    * JDK: Improve DTLS handshaking (CVE-2026-46917)

    * JDK: Enhance JPEG handling (CVE-2026-47010)

    * JDK: Enhance XBM image support (CVE-2026-47021)

    * JDK: Enhance Jar file processing (CVE-2026-47027)

    * JDK: Improve certification checking (CVE-2026-60147)

    * JDK: Enhance AWT ImagingLib (CVE-2026-47059)

    * JDK: Enhance Jar handling (CVE-2026-47063)

    * JDK: Update LCMS to 2.19 (CVE-2026-41254)

    Enhancement(s):

    * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball     available on the customer portal.  The single portable build has a release number ('p') and each RPM has     its own release number ('r').  However, the RPM naming only showed the RPM release number, while the     version output from the build showed the portable release number, making it unclear that they were     different numbers.  From this release onwards, a release field of the form 'p.r' is always used for RPMs     and the version output shows 'p'. (RHEL-212337, RHEL-212338, RHEL-212339, RHEL-212340, RHEL-212342,     RHEL-212343)

    Bug Fix(es):

    * In previous releases, the RPM did not correctly own the subdirectories used for documentation in     /usr/share/doc and /usr/share/javadoc.  This is fixed in this release, so these subdirectories will be     removed when the package is uninstalled. (RHEL-212353, RHEL-212359, RHEL-212360, RHEL-212361)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:42887 advisory.

    * JDK: Enhance TLS certificate handling (CVE-2026-46968)
      * JDK: Improve DTLS handshaking (CVE-2026-46917)
      * JDK: Enhance JPEG handling (CVE-2026-47010)
      * JDK: Enhance XBM image support (CVE-2026-47021)
      * JDK: Enhance Jar file processing (CVE-2026-47027)
      * JDK: Improve certification checking (CVE-2026-60147)
      * JDK: Enhance AWT ImagingLib (CVE-2026-47059)
      * JDK: Enhance Jar handling (CVE-2026-47063)
      * JDK: Update LCMS to 2.19 (CVE-2026-41254)


    Enhancement(s):

      * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball     available on the customer portal. The single portable build has a release number ('p') and each RPM has     its own release number ('r'). However, the RPM naming only showed the RPM release number, while the     version output from the build showed the portable release number, making it unclear that they were     different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs     and the version output shows 'p'. (AlmaLinux-212474, AlmaLinux-212475, AlmaLinux-212476, AlmaLinux-212477,     AlmaLinux-212478, AlmaLinux-212479, AlmaLinux-212480, AlmaLinux-212481)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22944-1 advisory.

    This update for java-17-openjdk fixes the following issues

    - Upgrade to upstream tag jdk-17.0.20+8 (July 2026 CPU)
    - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize     (bsc#1264994).
    - CVE-2026-46917: partial denial of service via TLS (bsc#1272223).
    - CVE-2026-46968: unauthorized creation, deletion or modification access to critical data (bsc#1272224).
    - CVE-2026-47010: unauthorized update, insert or delete access (bsc#1272225).
    - CVE-2026-47021: partial denial of service via multiple network protocols (bsc#1272227).
    - CVE-2026-47027: partial denial of service via multiple network protocols (bsc#1272228).
    - CVE-2026-47059: partial denial of service via multiple network protocols (bsc#1272235).
    - CVE-2026-47063: unauthorized creation, deletion or modification access to critical data (bsc#1272236).
    - CVE-2026-60147: unauthorized update, insert or delete access (bsc#1272237).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2022 advisory.

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 11.0.31,     17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise     Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via     TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful     attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service     (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This     vulnerability can only be exploited by supplying data to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1     Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2026-46917)

    Vulnerability in Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java     SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and     21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via TLS to compromise Oracle Java SE.  Successful attacks of     this vulnerability can result in  unauthorized creation, deletion or modification access to critical data     or all Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to     APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java     applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). (CVE-2026-46968)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: ImageIO).  Supported versions that are affected are Oracle Java SE: 8u491,     8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11;
    Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2026-47010)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u491,     8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11;
    Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2026-47021)

    Vulnerability in Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle     Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and     21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of     service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2026-47027)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u491,     8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11;
    Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted     code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2026-47059)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u491,     8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11;
    Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized     creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs     in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). (CVE-2026-47063)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u491,     8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11;
    Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE,     Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Confidentiality and     Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). (CVE-2026-60147)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2020 advisory.

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 11.0.31,     17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise     Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via     TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful     attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service     (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This     vulnerability can only be exploited by supplying data to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1     Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
    (CVE-2026-46917)

    Vulnerability in Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java     SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and     21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via TLS to compromise Oracle Java SE.  Successful attacks of     this vulnerability can result in  unauthorized creation, deletion or modification access to critical data     or all Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to     APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java     applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). (CVE-2026-46968)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: ImageIO).  Supported versions that are affected are Oracle Java SE: 8u491,     8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11;
    Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2026-47010)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u491,     8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11;
    Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2026-47021)

    Vulnerability in Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle     Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and     21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of     service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2026-47027)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u491,     8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11;
    Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted     code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2026-47059)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u491,     8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11;
    Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized     creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs     in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). (CVE-2026-47063)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u491,     8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11;
    Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE,     Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Confidentiality and     Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). (CVE-2026-60147)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
329096	RHEL 8 / 9 : java-17-openjdk (RHSA-2026:42887)	Nessus	Red Hat Local Security Checks	2026/7/23	2026/7/24	high
329192	RHEL 10 / 8 / 9 : java-21-openjdk (RHSA-2026:42895)	Nessus	Red Hat Local Security Checks	2026/7/23	2026/7/30	high
329333	AlmaLinux 9 : java-17-openjdk (ALSA-2026:42887)	Nessus	Alma Linux Local Security Checks	2026/7/24	2026/7/31	high
330544	SUSE SLED15: java-25-openjdk / java-25-openjdk-demo / java-25-openjdk-devel / etc (SUSE-SU-2026:3331-1)	Nessus	SuSE Local Security Checks	2026/7/29	2026/7/29	high
330556	SUSE SLES16: java-17-openjdk / java-17-openjdk-demo / java-17-openjdk-devel / etc (SUSE-SU-2026:22944-1)	Nessus	SuSE Local Security Checks	2026/7/29	2026/7/29	high
332014	Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2026-2022)	Nessus	Amazon Linux Local Security Checks	2026/8/4	2026/8/4	high
332049	Amazon Linux 2023 : java-25-amazon-corretto, java-25-amazon-corretto-devel, java-25-amazon-corretto-headless (ALAS2023-2026-2020)	Nessus	Amazon Linux Local Security Checks	2026/8/4	2026/8/4	high

检测

插件搜索

high

high

high

high

high

high

high