Oracle Java SE Multiple Vulnerabilities (October 2026 CPU)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(372932);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/28");

  script_cve_id(
    "CVE-2024-4367",
    "CVE-2024-47778",
    "CVE-2026-101516",
    "CVE-2026-101737",
    "CVE-2026-1940",
    "CVE-2026-20643",
    "CVE-2026-20664",
    "CVE-2026-20665",
    "CVE-2026-20691",
    "CVE-2026-28847",
    "CVE-2026-28857",
    "CVE-2026-28859",
    "CVE-2026-28861",
    "CVE-2026-28871",
    "CVE-2026-28883",
    "CVE-2026-28901",
    "CVE-2026-28902",
    "CVE-2026-28903",
    "CVE-2026-28904",
    "CVE-2026-28905",
    "CVE-2026-28907",
    "CVE-2026-28942",
    "CVE-2026-28946",
    "CVE-2026-28947",
    "CVE-2026-28953",
    "CVE-2026-28955",
    "CVE-2026-28958",
    "CVE-2026-28984",
    "CVE-2026-2921",
    "CVE-2026-39044",
    "CVE-2026-39872",
    "CVE-2026-43658",
    "CVE-2026-43660",
    "CVE-2026-43663",
    "CVE-2026-43676",
    "CVE-2026-43699",
    "CVE-2026-43701",
    "CVE-2026-43705",
    "CVE-2026-43707",
    "CVE-2026-43712",
    "CVE-2026-43713",
    "CVE-2026-43715",
    "CVE-2026-43716",
    "CVE-2026-43720",
    "CVE-2026-43721",
    "CVE-2026-43725",
    "CVE-2026-43726",
    "CVE-2026-43727",
    "CVE-2026-43731",
    "CVE-2026-43732",
    "CVE-2026-43734",
    "CVE-2026-43740",
    "CVE-2026-43742",
    "CVE-2026-43745",
    "CVE-2026-43804",
    "CVE-2026-46469",
    "CVE-2026-46470",
    "CVE-2026-64713",
    "CVE-2026-64719",
    "CVE-2026-64728",
    "CVE-2026-64730",
    "CVE-2026-64757",
    "CVE-2026-64783",
    "CVE-2026-64787",
    "CVE-2026-6732",
    "CVE-2026-83374",
    "CVE-2026-83376",
    "CVE-2026-83378",
    "CVE-2026-83380",
    "CVE-2026-83381",
    "CVE-2026-83387",
    "CVE-2026-83395",
    "CVE-2026-83400",
    "CVE-2026-87255",
    "CVE-2026-87290",
    "CVE-2026-87291",
    "CVE-2026-87292",
    "CVE-2026-87293",
    "CVE-2026-87294",
    "CVE-2026-87367",
    "CVE-2026-91332",
    "CVE-2026-91333",
    "CVE-2026-91334",
    "CVE-2026-91335",
    "CVE-2026-91373",
    "CVE-2026-91374",
    "CVE-2026-91375",
    "CVE-2026-91379",
    "CVE-2026-91380",
    "CVE-2026-91381",
    "CVE-2026-91382",
    "CVE-2026-91385",
    "CVE-2026-91394",
    "CVE-2026-91395",
    "CVE-2026-91396",
    "CVE-2026-91397",
    "CVE-2026-91398",
    "CVE-2026-91400",
    "CVE-2026-91402",
    "CVE-2026-91409",
    "CVE-2026-91410",
    "CVE-2026-91411",
    "CVE-2026-91415",
    "CVE-2026-91417",
    "CVE-2026-91418",
    "CVE-2026-91451",
    "CVE-2026-91452",
    "CVE-2026-91453",
    "CVE-2026-91461",
    "CVE-2026-91462",
    "CVE-2026-91463",
    "CVE-2026-91464",
    "CVE-2026-91477",
    "CVE-2026-91484",
    "CVE-2026-91487"
  );
  script_xref(name:"IAVA", value:"2026-A-1168");

  script_name(english:"Oracle Java SE Multiple Vulnerabilities (October 2026 CPU)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2 and 27 releases of
Oracle Java SE installed on the remote host are affected by multiple vulnerabilities as referenced in
the October 2026 CPU advisory.

  - Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX
    (WebKitGTK)). Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4
    and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple
    protocols to compromise Oracle Java SE, Oracle JavaFX. Successful attacks require human interaction from a
    person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle
    Java SE, Oracle JavaFX. (CVE-2026-43660)

  - Vulnerability in Oracle Java SE (component: Java plugin). Supported versions that are affected are Oracle
    Java SE: 8u503 and 8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon
    to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. While the vulnerability is
    in Oracle Java SE, attacks may significantly impact additional products (scope change). (CVE-2026-91484)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of
    Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf,
    11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle
    GraalVM Enterprise Edition: 21.3.19.1.1. Successful attacks of this vulnerability can result in unauthorized
    ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for
    JDK, Oracle GraalVM Enterprise Edition as well as unauthorized update, insert or delete access to some of
    Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized
    read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition
    accessible data. (CVE-2026-91415)

Note that Nessus has not tested for these issues but has instead relied only on the application's
self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/docs/tech/security-alerts/cpuoct2026csaf.json");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cpuoct2026.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade the affected installations of Oracle Java SE to version 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 or
27.0.1. For Oracle Java SE 26, apply the appropriate patch according to the October 2026 Oracle
Critical Patch Update advisory.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-43660");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:jre");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:jdk");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("sun_java_jre_installed.nasl", "sun_java_jre_installed_unix.nasl");
  script_require_keys("installed_sw/Java");

  exit(0);
}

include('vcf_extras.inc');

var app_list = ['Oracle Java'];

var app_info = vcf::java::get_app_info(app:app_list);

var constraints = [
  { 'min_version' : '8.0.0', 'fixed_version' : '8.0.511' },
  { 'min_version' : '11.0.0', 'fixed_version' : '11.0.33' },
  { 'min_version' : '17.0.0', 'fixed_version' : '17.0.21' },
  { 'min_version' : '21.0.0', 'fixed_version' : '21.0.13' },
  { 'min_version' : '25.0.0', 'fixed_version' : '25.0.5' },
  # Oracle published no publicly downloadable fixed build for the 26 branch, so this constraint uses
  # max_version + fixed_display instead of fixed_version. The '26.0.2.999' ceiling catches 4-segment
  # sub-builds (26.0.2.x) reported by the Java detector.
  { 'min_version' : '26.0.0', 'max_version' : '26.0.2.999', 'fixed_display' : 'Apply the October 2026 Oracle Critical Patch Update' },
  { 'min_version' : '27.0.0', 'fixed_version' : '27.0.1' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);