Patchmageddon

Vendor & Third-Party Application JVMs

Advisory for the Java you don't build yourself, including commercial products, appliances and vendor-bundled runtimes, so they get patched or protected instead of forgotten.

The JVMs nobody owns

A large share of the Java in an enterprise wasn't written there. Application servers, database tooling, CI/CD servers, monitoring agents, ETL tools, security appliances and desktop software often ship their own private JVM, installed outside the package manager and invisible to anything that only checks the system java.

These runtimes fall between two chairs. The platform team assumes the vendor patches them; the vendor assumes you'll apply their next release; the application owner assumes it's all fine. Meanwhile the bundled JVM ages.

What we do

  • Find and attribute them. Discovery surfaces bundled runtimes and ties each one to a product, version and business owner.
  • Establish the supportability position. For each product: does the vendor ship JVM updates, do they support replacing the bundled runtime, and which JDK builds do they certify?
  • Patch what can be patched. Through vendor updates or supported runtime swaps, rolled out with the same detection and rollback discipline as your own apps.
  • Protect what can't. Network isolation, disabling vulnerable features, tighter access. The compensating controls are documented so your risk register reflects reality.
  • Take it to the vendor. Certified-JDK questions, SBOM requests and patch-timeline commitments, backed by the specific evidence you need for a contract conversation.
Some commercial products include a restricted Oracle Java license for use with that product only. Whether a bundled Oracle runtime creates licensing exposure depends on the product's terms, so we check them rather than assuming either way.

Further reading

Vendor & Third-Party Apps

Patching the JVMs you didn't install: Java inside vendor products

Many commercial products ship their own Java runtime. Why scanners miss them, what vendors will support, and how to handle the ones you can't patch yourself.
5 min read

Critical Patch Assurance

For business-critical Java applications, we compress testing instead of removing it, so full rigor fits a faster patch cadence.

Continuous Drift Monitoring

Keep your JVM inventory, patch posture and Oracle license exposure current as the estate changes, instead of commissioning a new assessment every year.