OpenJDK Vulnerabilities Disclosed Today Set an All-Time High; Azul Patches Them All

SUNNYVALE, Calif. - Oct. 20, 2026 - Azul, the trusted leader in enterprise Java for today's AI-first world, today released its October Security-only, Stability-first™ updates for Azul Core that are immediately deployable to address all 53 vulnerabilities disclosed in the latest OpenJDK quarterly update. Azul's Security-only, Stability-first updates contain security fixes and nothing else: no new features, enhancements or unrelated changes that can cause problems. The number of vulnerabilities disclosed in this quarter's OpenJDK release is the most in a single update in well over a decade and 7x greater than the two-year average of 7.6 Common Vulnerabilities and Exposures (CVEs) per quarter.

OpenJDK quarterly updates that include the fixes to these CVEs also include more than 150 code changes unrelated to security. Azul is the only vendor to offer both monthly and quarterly updates scoped to just security fixes. Enterprises can deploy Azul's Security-only, Stability-first updates to production immediately and safely to remediate critical vulnerabilities. Other OpenJDK distributions bundle non-security bug fixes, enhancements and even features in their updates, often causing regressions. While such regressions may get fixed with follow-on updates, they can significantly delay the deployment of urgent security fixes.

AI Is Exposing Flaws and Enabling Exploits Faster than Ever

CSO recently reported that researchers using an AI tool found a 13-year-old remote code execution flaw in Apache ActiveMQ in about 10 minutes. Two weeks after disclosure, nearly 6,500 internet-facing instances were still unpatched. In a case documented by GreyNoise, a suspected attacker used hundreds of AI agents to chain two zero-day flaws in PaperCut NG/MF, going from an empty workspace to remote code execution in under four hours. The agents ultimately reached at least 440 instances across 395 organizations in 48 countries, with full domain administrator control in seven minutes.

Java has been running mission-critical systems for more than 30 years, making it one of the most battle-tested platforms in enterprise computing. But AI is now exposing flaws that survived years of testing and review. Researchers are using it to uncover vulnerabilities in decades-old code, while threat actors use agentic AI to find and exploit them at a speed and scale never seen before. Because the vast majority of enterprises rely on Java for production applications and infrastructure, the impact will be felt in every industry and region. And the risk is immediate, for three reasons:

• The skill barrier is falling. AI lets less-skilled attackers do work that once required experts.
• Attackers are outpacing defenders. Mean time to exploit (MTTE) has shrunk to -7 days, meaning exploitation often begins before a patch is available, while the median enterprise patch cycle is 43 days.
• It is no longer safe to delay addressing low-severity CVEs. AI can chain even low-severity CVEs into effective and significant attacks, multiplying the number of exploitable paths.

Enterprises' Patch Deployment Cycles Have Not Kept Pace With AI-Speed Attackers

In the past, it may have been acceptable to wait weeks or months for stable, regression-free security updates before addressing known vulnerabilities - that timeline no longer works. Attackers are moving faster. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) maintain a Known Exploited Vulnerabilities (KEV) catalog that lists flaws confirmed to be under active attack. According to Azul's analysis of that catalog, 61% of vulnerabilities published in 2025 that were later exploited were added within 30 days of public disclosure[1]. The true share is likely higher: the figure excludes the roughly one in four exploited vulnerabilities already listed on or before disclosure day, and CISA typically lists a flaw only after exploitation has begun. For most exploited vulnerabilities, the window between disclosure and attack is now measured in days, not weeks or months.

Security-Only, Stability-First Updates Ready for Immediate Deployment

Azul is the only vendor to offer Security-only, Stability-first quarterly, monthly and out-of-cycle OpenJDK updates, which contain only security fixes, with no new features or unrelated bug fixes. These are built on the previous quarter's stabilized full patch update, which Azul and the broader Java community have already tested extensively. With changes limited to security fixes only, the potential surface for regression is dramatically reduced. Since 2020[2], more than 20% of OpenJDK quarterly updates included regressions that prevented their timely rollouts. During that same time, no security-only updates from Azul have had deployment-preventing regressions, and Azul customers were able to deploy straight to production in rapid manner. In addition, Azul delivers monthly, Stability-first Critical Security Patch Updates (CSPUs) layered on the existing security-only quarterly update, a capability no other Java vendor or OpenJDK distribution offers.

Prior OpenJDK quarterly updates have included regressions as serious as breaking application access to all Google APIs, corrupting Tomcat HTTP content and breaking Hadoop deployments. Enterprises that relied on other OpenJDK distributions had to choose between customer impact and security. In contrast, Azul customers that deployed the Azul Core security-only update did not have to choose and were able to deploy immediately, safely and securely.

Azul Core is a Java SE-compliant build of OpenJDK that is certified with the Technology Compatibility Kit (TCK). Azul Core is a drop-in replacement for Oracle Java and other Java SE-compliant distributions. Azul Core subscribers get monthly and quarterly security-only updates, quarterly full updates and out-of-cycle fixes as needed for every LTS release (8, 11, 17, 21, 25)

Many enterprises also still run Java 6 and 7, an exposure in the age of AI-driven attacks. Azul is the only vendor that provides backported security fixes for these versions, extending the same monthly security cadence to organizations still running older Java in production.

Azul Partners Can Help Customers Close the Exposure Window

Azul's resellers and security services delivery partners are able to help their customers manage and remediate the quickly growing number of threats by taking the October update to security-conscious customers now. Resale and services for the Security-only, Stability-first updates are included in current Azul Core channel pricing.

Closing the Gap Between Disclosure and Deployment

"The record number of vulnerabilities in one OpenJDK update is a very real warning to all enterprises running their business-critical workloads on Java. AI has collapsed the time between disclosure and exploitation from weeks to days to hours, and attackers are chaining flaws that defenders used to rank as low priority," said Scott Sellers, co-founder and CEO of Azul. "Enterprises shouldn't have to choose between security and stability. Azul's Security-only, Stability-first updates are able to be deployed immediately, so customers can close the exposure window before an attacker finds it first."

Enterprises running Oracle Java, other OpenJDK builds or free Azul Zulu builds in production, or that want to shorten the time it takes to remediate the 53 vulnerabilities disclosed in today's quarterly update, can get patched with Azul today.

FAQs

What are Security-only, Stability-first updates?

Azul's Security-only, Stability-first™ updates contain security fixes and nothing else: no new features, enhancements or unrelated changes that can cause problems. Azul applies them to a previous update that has already been thoroughly tested and proven in production, so there is very little new code that could cause problems. Enterprises can deploy them straight to production without the lengthy delays caused by waiting for regression fixes that more than 20% of full updates have required in the past. Azul Core customers receive them quarterly, monthly and out of cycle when an urgent fix is needed.

What are some key Java-runtime related security risks enterprises face in 2026?

Key Java runtime-related security risks in 2026 include:

• a record volume of newly disclosed vulnerabilities,
• AI agents that find and chain lower-risk flaws into working exploits within hours, and
• runtimes that are end-of-life and no longer receive security fixes.

Azul Core, a commercially supported build of OpenJDK, delivers Security-only, Stability-first™ updates that feature only security fixes built on the previous quarter's full patch update that has been thoroughly tested by Azul and the broader Java community. This allows Azul to address the increasing scale and speed of security threats for all versions of Java, including older versions like Java 6 and 7. Azul's latest update is immediately deployable to production to address every vulnerability in the October 2026 quarterly update without the regression-testing burden of full updates that delay time to remediation.

How will AI-accelerated attacks change enterprise Java patching cadence?

Agentic AI shortens the time between vulnerability disclosure and working exploit from weeks to days and sometimes hours, which makes traditional quarterly patch cycles too slow. This is why Azul provides immediately deployable security-only, stability-first fixes not only on a quarterly and monthly basis, but also out-of-cycle patches to address fast-moving incidents like zero-day vulnerabilities.

What are the risks of using community OpenJDK instead of a commercially supported Java distribution?

Unsupported OpenJDK builds are typically released days to weeks after disclosure and then require extensive testing to guard against regression issues. An issue that an organization may uncover may not be addressed by the community on a timeline that meets enterprise requirements, and that organization may have to wait until the next quarterly release for the issue to be addressed. That wait leaves organizations exposed to known vulnerabilities. In contrast, customers of Azul Core receive security-only updates, out-of-cycle patches to address zero-days, as well as customer-specific bug fixes.

What is the fastest way to move unsupported Java runtimes onto a supported, patched distribution?

The fastest path is to inventory every Java runtime in production, then standardize on a drop-in replacement: a Java SE-compliant, Technology Compatibility Kit (TCK)-certified build of OpenJDK, such as Azul Core. Because it is a drop-in replacement, the move requires no code changes and can be done with minimal disruption, bringing every runtime under a single, supported patch stream with access to timely security-only updates.

About Azul

Azul is the trusted leader in enterprise Java for today's AI-first world. Its open source-based Java platform empowers organizations to optimize the entire Java lifecycle to accelerate performance, strengthen security, reduce licensing and cloud costs, and boost developer productivity. Azul powers mission-critical systems for 37% of the Fortune 100, 50% of the Forbes Top 10 World's Most Valuable Brands, and the world's top 10 financial trading companies. Learn more at azul.com and follow @azulsystems.

# # #

Media Contact for Azul:

Treble
Josh Georgiou
[email protected]

[1] Azul analysis of CISA KEV catalog data, Oct. 2026 (2025-published CVEs, n=126; excludes zero-days). Figures are a floor.

[2] Based on Azul records.