Oracle Java SE Vulnerability (Security Alert CVE-2026-114820)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(372933);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/29");

  script_cve_id("CVE-2026-114820");

  script_name(english:"Oracle Java SE Vulnerability (Security Alert CVE-2026-114820)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Java installed on the remote host is prior to 8u511-b33, 11.0.33.0.3, 17.0.21.0.3, 21.0.13.0.3,
25.0.5.0.3, or 27.0.1.0.3. It is, therefore, affected by a vulnerability as referenced in the Oracle Security Alert
for CVE-2026-114820. The fixed releases remove the impacted eMudhra root CA certificates from the JDK cacerts
keystore.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of
    Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32,
    8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK:
    17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability
    allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE,
    Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result
    in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle
    GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical
    data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition
    accessible data. (CVE-2026-114820)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/alert-cve-2026-114820.html");
  script_set_attribute(attribute:"see_also", value:"https://ops.java/emudhra");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Java SE 8u511-b33, 11.0.33.0.3, 17.0.21.0.3, 21.0.13.0.3, 25.0.5.0.3, or 27.0.1.0.3 as appropriate per
the Oracle Security Alert for CVE-2026-114820.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-114820");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:jre");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:jdk");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("sun_java_jre_installed.nasl", "sun_java_jre_installed_unix.nasl");
  script_require_keys("installed_sw/Java");

  exit(0);
}

include('vcf_extras.inc');

var app_list = ['Oracle Java'];

# The Security Alert fixes are a 5th-segment patch release (11.0.33.0.2 -> 11.0.33.0.3) and, for
# Java 8, a new build (8u511-b32 -> 8u511-b33, compared as 8.0.511.33), so request 5 version segments.
# vcf::java::trim_version() still caps version_without_one at 3 segments, so a patched 11.0.33.0.3 or
# 8u511-b33 install compares as 11.0.33 or 8.0.511 and is reported (same limitation as the
# August 2026 CSPU plugins, see RES-234627).
var app_info = vcf::java::get_app_info(app:app_list, max_segs:5);

var constraints = [
  { 'min_version' : '8.0.0', 'fixed_version' : '8.0.511.33', 'fixed_display' : 'Upgrade to version 8.0.511.33 (8u511-b33) or greater' },
  { 'min_version' : '11.0.0', 'fixed_version' : '11.0.33.0.3', 'fixed_display' : 'Upgrade to version 11.0.33.0.3 or greater' },
  { 'min_version' : '17.0.0', 'fixed_version' : '17.0.21.0.3', 'fixed_display' : 'Upgrade to version 17.0.21.0.3 or greater' },
  { 'min_version' : '21.0.0', 'fixed_version' : '21.0.13.0.3', 'fixed_display' : 'Upgrade to version 21.0.13.0.3 or greater' },
  { 'min_version' : '25.0.0', 'fixed_version' : '25.0.5.0.3', 'fixed_display' : 'Upgrade to version 25.0.5.0.3 or greater' },
  { 'min_version' : '27.0.0', 'fixed_version' : '27.0.1.0.3', 'fixed_display' : 'Upgrade to version 27.0.1.0.3 or greater' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);