Oracle Java SE Multiple Vulnerabilities (August 2026 CSPU)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338352);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id(
    "CVE-2026-60589",
    "CVE-2026-61308",
    "CVE-2026-62574",
    "CVE-2026-70907"
  );

  script_name(english:"Oracle Java SE Multiple Vulnerabilities (August 2026 CSPU)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2 versions of Java installed on the remote host are affected by
multiple vulnerabilities as referenced in the August 2026 CSPU advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of
    Oracle Java SE (component: Install). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32,
    17.0.20, 21.0.12, 25.0.4, 26.0.2. Easily exploitable vulnerability allows low privileged attacker with logon
    to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. Successful attacks of this
    vulnerability can result in takeover of Oracle Java SE. (CVE-2026-62574)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of
    Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32,
    17.0.20, 21.0.12, 25.0.4, 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with
    network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise
    Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial
    denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise
    Edition. (CVE-2026-70907)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of
    Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u501,
    11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2. Difficult to exploit vulnerability allows unauthenticated attacker
    with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise
    Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or
    complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible
    data. (CVE-2026-61308)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/docs/tech/security-alerts/cspuaug2026csaf.json");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cspuaug2026.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, or 26.0.2.1 as appropriate per the August
2026 Oracle Critical Security Patch Update (CSPU) advisory.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-61308");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-62574");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:jre");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:jdk");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("sun_java_jre_installed.nasl", "sun_java_jre_installed_unix.nasl");
  script_require_keys("installed_sw/Java");

  exit(0);
}

include('vcf_extras.inc');

var app_list = ['Oracle Java'];

# The Aug 2026 CSPU fixes 11/17/21/25/26 with a 4th-segment patch release (ex. 25.0.4.1),
# so request 4 version segments to distinguish patched builds from the affected GA builds.
var app_info = vcf::java::get_app_info(app:app_list, max_segs:4);

var constraints = [
  { 'min_version' : '8.0.0', 'fixed_version' : '8.0.503', 'fixed_display' : 'Upgrade to version 8.0.503 or greater' },
  { 'min_version' : '11.0.0', 'fixed_version' : '11.0.32.1', 'fixed_display' : 'Upgrade to version 11.0.32.1 or greater' },
  { 'min_version' : '17.0.0', 'fixed_version' : '17.0.20.1', 'fixed_display' : 'Upgrade to version 17.0.20.1 or greater' },
  { 'min_version' : '21.0.0', 'fixed_version' : '21.0.12.1', 'fixed_display' : 'Upgrade to version 21.0.12.1 or greater' },
  { 'min_version' : '25.0.0', 'fixed_version' : '25.0.4.1', 'fixed_display' : 'Upgrade to version 25.0.4.1 or greater' },
  { 'min_version' : '26.0.0', 'fixed_version' : '26.0.2.1', 'fixed_display' : 'Upgrade to version 26.0.2.1 or greater' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);