Oracle JDK 21's free update window has closed. Here's what that means.

In September 2026, Oracle JDK 21 reached the end of its free commercial update window. If your organization runs Oracle JDK 21 in production and expects to keep patching it, the terms under which you receive those patches have changed.

This isn't a new policy. Oracle announced the model when it introduced the No-Fee Terms and Conditions (NFTC) license with JDK 17 in 2021, and the same thing happened to JDK 17 in 2024. Many teams treat "Oracle made Java free again" as a settled fact, though. For anyone on JDK 21 that is no longer true in the way that matters for security.

How the NFTC license actually works

Starting with JDK 17, Oracle released Oracle JDK under the NFTC license, which allows free use, including commercial production use. The free period for each long-term support (LTS) release is time-limited:

• An LTS release gets NFTC updates until one year after the next LTS release ships.
• After that, further updates for that release are published under the Oracle Technology Network (OTN) License Agreement for Java SE. OTN allows personal, development and some other uses, but production commercial use needs a paid Java SE subscription.

Applied to recent LTS releases:

The JDK 25 date depends on Oracle keeping its two-year LTS cadence and its current NFTC terms. Both are Oracle's decisions, so treat the date as an expectation, not a guarantee.

What changed, precisely

This is where a lot of internal conversations go wrong, so it's worth being exact.

Builds already released under NFTC stay under NFTC. If a server runs an Oracle JDK 21 update that was released under NFTC, that binary didn't change licenses overnight on September 16.

What changed is what happens next. Oracle JDK 21 updates released after the cutoff, starting with the next quarterly Critical Patch Update, come under the OTN license. Applying one of those updates to a production system without a subscription is where the compliance exposure starts.

So the real question isn't "is our Java 21 still free?" It's this:

Do we want to keep receiving security patches for Oracle JDK 21 in production?

If yes, you pay. If no, the runtime stops getting security fixes, and each quarter adds new published CVEs against it. There isn't a free way to keep patching Oracle JDK 21.

The October patch is the trap

Oracle and the OpenJDK community release Java security updates quarterly: January, April, July and October. The October 2026 Critical Patch Update is the first Oracle JDK 21 update outside the free window.

In most estates, nobody will make a conscious decision to accept OTN terms. It will happen through normal operations:

• A platform team applies the October CPU on schedule because that's their job.
• A golden image or base container image picks up the latest Oracle JDK 21 in its next rebuild.
• An installer, configuration-management role or package repository mirror pulls "latest 21" by default.
• A vulnerability scanner flags the old build as outdated and someone raises a ticket to update it.

Each of these is good security hygiene, and each can move a system from free to licensable without anyone in procurement knowing. This is the same pattern many organizations saw with JDK 17 in late 2024.

Your three options

1. Subscribe

You can buy the Oracle Java SE Universal Subscription and keep patching Oracle JDK 21. This is a legitimate choice, especially where an application vendor certifies only Oracle JDK, or where you want Oracle's support.

Know what you're buying: the subscription is priced per employee across the whole organization, not per install. A small Oracle JDK footprint can still produce a large bill. We explain how the metric works in how Oracle's employee-based Java metric works.

2. Move to Oracle JDK 25 under NFTC

JDK 25 is the current LTS and, at the time of writing, its updates are free under NFTC until roughly September 2028. Upgrading buys time.

It also means doing a major version upgrade, 21 to 25, which is a real engineering project, not a patch. The same cliff returns in about two years, when you'll need to decide again between paying, migrating and upgrading. Some teams are comfortable running that treadmill. Many decide it's cheaper to step off it once.

3. Migrate to an OpenJDK distribution

Oracle JDK is built from the OpenJDK source code. Several vendors ship free, TCK-tested OpenJDK builds with long-term security updates for JDK 21, and most also sell commercial support:

• Eclipse Temurin (Eclipse Adoptium)
• Amazon Corretto
• Azul Zulu
• Red Hat build of OpenJDK
• Microsoft Build of OpenJDK
• BellSoft Liberica
• IBM Semeru Runtimes (built on the Eclipse OpenJ9 VM instead of HotSpot, so it's a bigger change than the others)

For most server workloads, moving from Oracle JDK 21 to another vendor's JDK 21 is a same-version swap. It's lower risk than a major version upgrade, but it isn't zero risk. Trust stores, installer layout, bundled tooling and some defaults differ between vendors. Our Oracle JDK to OpenJDK migration checklist covers what to verify.

Picking between them

Most estates end up with a mix. A few applications stay on Oracle because a vendor requires it. Most move to OpenJDK. A handful of teams already planning a 25 upgrade just bring it forward.

You can't make that decision well without knowing where every Oracle JDK 21 install actually is, who owns it and what depends on it.

What to do this quarter

1. Find every Oracle JDK in the estate. That includes the JDKs bundled inside vendor products, container images and build agents, not only the ones on your standard server builds. See finding every JVM in your estate.
2. Freeze automatic updates to Oracle JDK 21 until a decision is made, so the October CPU doesn't make the decision for you.
3. Split the inventory into three groups: migrate to OpenJDK, upgrade to 25, or keep on Oracle with a subscription. Record the reason for each keep.
4. Move the easy majority first. Same-version swaps on non-critical apps with good rollback can move quickly. See fast detection and rollback instead of regression testing.
5. Keep evidence. Record what was removed, when and where. If Oracle raises a licensing review later, dated evidence is what you'll want.

What to do next

If you don't have a current, trustworthy list of your Oracle JDK installs, start there. Our JVM discovery and estate assessment finds them, including the ones hidden inside other products. Our OpenJDK migration service moves them off Oracle on a fixed timeline.