The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (Spring Framework)). Supported versions that are affected are 22.12.0-22.12.15,     23.12.0-23.12.16, 24.12.0-24.12.16 and 25.12.0-25.12.9. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks     of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera     Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of     Primavera Unifier. (CVE-2026-22735, CVE-2026-22741, CVE-2026-22745, CVE-2026-41838, CVE-2026-41839,     CVE-2026-41840, CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41845,     CVE-2026-41846, CVE-2026-41848, CVE-2026-41850, CVE-2026-41851, CVE-2026-41852, CVE-2026-41854,     CVE-2026-41855)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (jsoup)). Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16,     24.12.0-24.12.16 and 25.12.0-25.12.9. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera     Unifier. (CVE-2026-75140)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (jackson-databind)). Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15,     23.12.0-23.12.16, 24.12.0-24.12.16 and 25.12.0-25.12.9. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks     of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Primavera Unifier. (CVE-2026-19032, CVE-2026-68497, CVE-2026-91777)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core).
    Supported versions that are affected are 21.12.0-21.12.17. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks     of this vulnerability can result in unauthorized creation, deletion or modification access to critical     data or all Primavera Unifier accessible data as well as unauthorized access to critical data or complete     access to all Primavera Unifier accessible data. (CVE-2026-101736)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project     Control). Supported versions that are affected are 23.12.0-23.12.16. Easily exploitable vulnerability     allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful     attacks of this vulnerability can result in unauthorized creation, deletion or modification access to     critical data or all Primavera Unifier accessible data as well as unauthorized read access to a subset of     Primavera Unifier accessible data. (CVE-2026-101735)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 13.5.0.0 and 24.1.0.0 versions of Enterprise Manager Cloud Control installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory.

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Oracle Management Service (Apache Commons BeanUtils)). Supported versions that are affected     are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via     HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can     result in takeover of Oracle Enterprise Manager Base Platform. (CVE-2025-48734)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise     Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle     Enterprise Manager Base Platform. (CVE-2026-101518)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Security Framework (jackson-databind)). Supported versions that are affected are 13.5 and     24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in     takeover of Oracle Enterprise Manager Base Platform. (CVE-2026-54512, CVE-2026-54513)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3273-1 advisory.

    - CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of       @JsonIgnoreProperties exclusions (bsc#1268902).
    - CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized     writes to       @JsonView restricted fields (bsc#1271440).
    - CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a     bypass of       @JsonIgnore restrictions (bsc#1271442).

    Changes for jackson-annotations:

    - Update to 2.18.9.

    Changes for jackson-bom:

    - Update to 2.18.9.

    Changes for jackson-core:

    - Update to 2.18.9.

    Changes for jackson-databind:

    - Update to 2.18.9:

     * honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).

    Changes for jackson-dataformats-binary:

    - Update to 2.18.9.

    Changes for jackson-modules-base:

    - Update to 2.18.9.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory.

  - Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are     affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows     unauthenticated attacker with access to the physical communication segment attached to the hardware where     the Portable Clusterware executes to compromise Portable Clusterware. While the vulnerability is in     Portable Clusterware, attacks may significantly impact additional products (scope change). Successful     attacks of this vulnerability can result in takeover of Portable Clusterware. (CVE-2026-71063,     CVE-2026-71064)

  - Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are     affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Portable Clusterware. Successful     attacks of this vulnerability can result in unauthorized creation, deletion or modification access to     critical data or all Portable Clusterware accessible data and unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Portable Clusterware. (CVE-2026-71102)

  - Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are     23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Authenticated User     privilege with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability     can result in unauthorized access to critical data or complete access to all RDBMS accessible data and     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of RDBMS.
    (CVE-2026-71062)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67604 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java     applications based on the WildFly application runtime.

    This asynchronous patch is a security update for Red Hat JBoss Enterprise     Application Platform 7.4.

    Security Fix(es):

    * artemis-server: Apache Artemis  session hijack via missing authentication (CVE-2026-57967)

    * artemis-server: artemis core protocol permits unauthed queue creation (CVE-2026-49362)

    * jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped     properties (CVE-2026-59889)

    * jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified (CVE-2026-54515)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgements, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70228 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss  Enterprise Application Platform 8.1.8 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 8.1.7, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.8 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser [eap-8.1.z]     (CVE-2026-68494)

    * netty-codec-http2: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [eap-8.1.z]     (CVE-2026-56745)

    * netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration     [eap-8.1.z] (CVE-2026-62243)

    * bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute     subpacket length [eap-8.1.z] (CVE-2026-59649)

    * jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified [eap-8.1.z]     (CVE-2026-54515)

    * jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped     properties [eap-8.1.z] (CVE-2026-59889)

    * netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain     Names [eap-8.1.z] (CVE-2026-73508)

    * jboss-eap.1-runtime-maven-repository.zip: jackson-core: Denial of Service via incomplete fix in async     JSON parser [eap-8.1.z] (CVE-2026-68494)

    * jboss-eap-runtime-maven-repository.zip: jackson-core: Denial of Service via incomplete fix in async JSON     parser [eap-8.1.z] (CVE-2026-68494)

    * bcprov-jdk18on: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion [eap-8.1.z]     (CVE-2026-3505)

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays [eap-8.1.z]     (CVE-2026-69152)

    * netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) [eap-8.1.z]     (CVE-2026-59899)

    * netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header     [eap-8.1.z] (CVE-2026-56746)

    * netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [eap-8.1.z]     (CVE-2026-56745)

    * netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing [eap-8.1.z]     (CVE-2026-55831)

    * netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification [eap-8.1.z]     (CVE-2026-55833)

    * jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution [eap-8.1.z]     (CVE-2026-54513)

    * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass     [eap-8.1.z] (CVE-2026-54512)

    * undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap [eap-8.1.z]     (CVE-2026-14180)

    * artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0     [eap-8.1.z] (CVE-2026-49363)

    * undertow-websockets-jsr: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with     any @OnMessage method [eap-8.1.z] (CVE-2026-15565)

    * wildfly-iiop-openjdk: Wildfly: Pre-auth denial of service on the IIOP listener [eap-8.1.z]     (CVE-2026-15567)

    * cxf-rt-transports-jms: Apache CXF: Arbitrary code execution via untrusted JMS configuration [eap-8.1.z]     (CVE-2026-50632)

    * cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing     JAXP hardening [eap-8.1.z] (CVE-2026-49875)

    * wildfly-elytron-asn1: Unbounded Memory Allocation in WildFly Elytron ASN.1 DERDecoder via Crafted DER     Payload [eap-8.1.z] (CVE-2026-10832)

    * cxf-rt-transports-jms: Apache CXF: Remote Code Execution via untrusted JMS configuration [eap-8.1.z]     (CVE-2026-44417)

    * wildfly-elytron-realm-token: parameter injection in EAP's elytron oauth2 [eap-8.1.z] (CVE-2026-85511)

    * jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include     [eap-8.1.z] (CVE-2026-46581)

    * wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS [eap-8.1.z]     (CVE-2026-15563)

    * jboss-remoting: jboss-remoting: integer overflow in MessageReader leads to pre-authentication denial of     service [eap-8.1.z] (CVE-2026-15562)

    * undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow [eap-8.1.z] (CVE-2026-15561)

    * openjdk-orb: unauthed class loading via IIOP in EAP [eap-8.1.z] (CVE-2026-15560)

    * artemis-server: Apache Artemis  session hijack via missing authentication [eap-8.1.z]     (CVE-2026-57967)

    * wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller     [eap-8.1.z] (CVE-2026-15555)

    * undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery [eap-8.1.z]     (CVE-2026-15554)

    * jgroups: artemis cluster password leak via jgroups spoof [eap-8.1.z] (CVE-2026-49364)

    * artemis-server: artemis core protocol permits unauthed queue creation [eap-8.1.z] (CVE-2026-49362)

    * artemis-server: artemis messaging handlers in Red Hat EAP permit deserialization by default [eap-8.1.z]     (CVE-2026-86404)

    * undertow-core: Undertow: Denial of Service via WebSocket permessage-deflate processing [eap-8.1.z]     (CVE-2026-5680)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory.

  - Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud     Manager). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the     vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products     (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud     Applications. (CVE-2026-101446)

  - Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI (Ruby)).
    Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful     attacks of this vulnerability can result in takeover of Siebel CRM End User. (CVE-2026-54906)

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface     (Apache Tomcat)). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification     access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to     critical data or complete access to all Siebel CRM Deployment accessible data. (CVE-2026-24733,     CVE-2026-41284, CVE-2026-43513, CVE-2026-43515, CVE-2026-59083)

  - Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing).
    Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged     attacker with network access via SQL to compromise Siebel Apps - Life Sciences. Successful attacks of this     vulnerability can result in takeover of Siebel Apps - Life Sciences. (CVE-2026-101457)

  - Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval     Manager). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development. Successful     attacks require human interaction from a person other than the attacker. Successful attacks of this     vulnerability can result in takeover of Siebel CRM Development. (CVE-2026-101495)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
370446	Oracle Primavera Unifier (October 2026 CPU)	Nessus	CGI abuses	2026/10/22	2026/10/26	high
370430	Oracle Enterprise Manager Cloud Control (October 2026 CPU)	Nessus	Misc.	2026/10/22	2026/11/10	high
330284	SUSE SLED15: jackson-annotations / jackson-core / jackson-databind / etc (SUSE-SU-2026:3273-1)	Nessus	SuSE Local Security Checks	2026/7/28	2026/7/28	medium
338071	Oracle Database Server (August 2026 CSPU)	Nessus	Databases	2026/8/19	2026/10/1	high
345911	RHEL 7 / 8 / 9 : Red Hat JBoss Enterprise Application Platform 7.4.25 (RHSA-2026:67604)	Nessus	Red Hat Local Security Checks	2026/9/15	2026/10/8	critical
348800	RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.1.8 (RHSA-2026:70228)	Nessus	Red Hat Local Security Checks	2026/9/22	2026/9/30	high
370447	Oracle Siebel Server <= 26.8 (October 2026 CPU)	Nessus	Misc.	2026/10/22	2026/10/26	high

偵測

搜尋 Plugin

high

high

medium

high

critical

high

high