[{"data":1,"prerenderedAt":1236},["ShallowReactive",2],{"services":3,"service-\u002Fservices\u002Fthird-party-applications":776,"service-articles-\u002Fservices\u002Fthird-party-applications":829,"service-surround-\u002Fservices\u002Fthird-party-applications":1233},[4,257,383,502,603,693],{"id":5,"title":6,"body":7,"category":238,"description":239,"engagement":240,"extension":241,"headline":242,"icon":243,"meta":244,"navigation":245,"order":246,"outcomes":247,"path":253,"seo":254,"stem":255,"__hash__":256},"services\u002Fservices\u002Fjvm-discovery.md","JVM Discovery & Estate Assessment",{"type":8,"value":9,"toc":228},"minimark",[10,15,24,27,31,34,79,83,93,125,129,206,210],[11,12,14],"h2",{"id":13},"the-problem","The problem",[16,17,18,19,23],"p",{},"Most enterprises can't produce an accurate, current list of the Java runtimes they run. The CMDB records some. Config management records others. The rest are ",[20,21,22],"strong",{},"shadow JVMs",": runtimes bundled inside vendor products, application servers, CI\u002FCD agents, monitoring tools, desktop software and container images that nobody thinks of as \"Java\".",[16,25,26],{},"Shadow JVMs are the ones that miss every patch cycle. For Oracle Java, they are also the installs that can put your entire headcount in scope for a subscription.",[11,28,30],{"id":29},"what-we-find","What we find",[16,32,33],{},"For every JVM across dev, staging and production we capture:",[35,36,37,44,50,56,62,68],"ul",{},[38,39,40,43],"li",{},[20,41,42],{},"Version, vendor and patch level",": Oracle JDK, Eclipse Temurin, Amazon Corretto, Azul Zulu, Red Hat, Microsoft, IBM Semeru and others",[38,45,46,49],{},[20,47,48],{},"Where it is embedded",": standalone apps, Tomcat, WebLogic, WebSphere, JBoss\u002FWildFly, vendor products, containers",[38,51,52,55],{},[20,53,54],{},"CVE exposure",", mapped to each version and scored so the worst exposure rises to the top",[38,57,58,61],{},[20,59,60],{},"Installed agents",": APM, security and profiling agents, which cause many patch failures",[38,63,64,67],{},[20,65,66],{},"Ownership",": who actually runs each application. This is often the hardest part to get right.",[38,69,70,73,74],{},[20,71,72],{},"Criticality signals"," that feed ",[75,76,78],"a",{"href":77},"\u002Fapproach#classification","application classification",[11,80,82],{"id":81},"how-we-do-it","How we do it",[84,85,86],"note",{},[16,87,88,89,92],{},"Discovery is ",[20,90,91],{},"read-only",". Nothing is patched, restarted or deployed, so the engagement doesn't need change-control approval, and the access we ask for is kept to a minimum.",[35,94,95,101,107,113,119],{},[38,96,97,100],{},[20,98,99],{},"Agentless scanning"," over SSH and WinRM (process listings and filesystem inspection) where possible",[38,102,103,106],{},[20,104,105],{},"Reconciliation against your CMDB and config management"," (Ansible, Puppet, Chef). The drift between what is recorded and what is running is a finding in its own right.",[38,108,109,112],{},[20,110,111],{},"Cloud provider APIs"," (AWS, Azure, GCP) for instance and container metadata",[38,114,115,118],{},[20,116,117],{},"Container image and artifact repository scanning"," (registries, Nexus, Artifactory) to catch JVMs before they are even running",[38,120,121,124],{},[20,122,123],{},"Reuse of the scanners you already own",". Tenable, Qualys, Snyk and JFrog Xray already collect useful data. We add the JVM-specific interpretation and a remediation plan; we don't sell you another scanner.",[11,126,128],{"id":127},"three-ways-to-engage","Three ways to engage",[130,131,132,151],"table",{},[133,134,135],"thead",{},[136,137,138,142,145,148],"tr",{},[139,140,141],"th",{},"Package",[139,143,144],{},"Scope",[139,146,147],{},"Turnaround",[139,149,150],{},"Purpose",[152,153,154,171,187],"tbody",{},[136,155,156,162,165,168],{},[157,158,159],"td",{},[20,160,161],{},"Quick Scan",[157,163,164],{},"One business unit or subset of the estate",[157,166,167],{},"Days",[157,169,170],{},"Prove what a full assessment will find",[136,172,173,178,181,184],{},[157,174,175],{},[20,176,177],{},"Full Estate Assessment",[157,179,180],{},"The whole estate",[157,182,183],{},"2–4 weeks",[157,185,186],{},"Complete inventory, risk report and remediation plan",[136,188,189,197,200,203],{},[157,190,191],{},[20,192,193],{},[75,194,196],{"href":195},"\u002Fservices\u002Fdrift-monitoring","Continuous Drift Monitoring",[157,198,199],{},"Ongoing",[157,201,202],{},"Subscription",[157,204,205],{},"Keep the inventory, risk and license picture current",[11,207,209],{"id":208},"what-you-walk-away-with","What you walk away with",[16,211,212,213,217,218,222,223,227],{},"The executive summary puts the findings in business terms: unbudgeted license exposure, days of exposure on unpatched critical CVEs, and the percentage of the estate on end-of-life versions. It ends with a direct recommendation of which applications belong in ",[75,214,216],{"href":215},"\u002Fservices\u002Frapid-patch","Rapid Patch",", which need ",[75,219,221],{"href":220},"\u002Fservices\u002Fcritical-patch-assurance","Critical Patch Assurance",", and which Oracle installs to ",[75,224,226],{"href":225},"\u002Fservices\u002Fopenjdk-migration","migrate or keep",".",{"title":229,"searchDepth":230,"depth":231,"links":232},"",2,3,[233,234,235,236,237],{"id":13,"depth":230,"text":14},{"id":29,"depth":230,"text":30},{"id":81,"depth":230,"text":82},{"id":127,"depth":230,"text":128},{"id":208,"depth":230,"text":209},"jvm-discovery","Find every JVM in your estate, including the ones bundled inside vendor products and containers, and turn the findings into a prioritized, costed remediation plan.","Read-only and fixed-price. A Quick Scan of one business unit takes days; a Full Estate Assessment takes two to four weeks. Nothing changes in production, so no CAB approval is needed.","md","Start here","i-lucide-radar",{},true,1,[248,249,250,251,252],"A complete inventory of every JVM, with version, vendor, patch level and location","CVE exposure scored per JVM, not a raw vulnerability count","Oracle Java license exposure quantified in dollars","Owners mapped for each application","An executive summary with a prioritized remediation plan","\u002Fservices\u002Fjvm-discovery",{"title":6,"description":239},"services\u002Fjvm-discovery","xwCt4w5iuENInyc5KpzKLmV4sk8GzNe5e1H4Q9b7mV8",{"id":258,"title":259,"body":260,"category":368,"description":369,"engagement":370,"extension":241,"headline":371,"icon":372,"meta":373,"navigation":245,"order":230,"outcomes":374,"path":225,"seo":380,"stem":381,"__hash__":382},"services\u002Fservices\u002Fopenjdk-migration.md","Oracle Java Licensing & OpenJDK Migration",{"type":8,"value":261,"toc":358},[262,266,273,279,287,293,297,302,309,313,316,320,323,327,335,339],[11,263,265],{"id":264},"why-this-is-urgent","Why this is urgent",[16,267,268,269,272],{},"Since January 2023, Oracle has sold Java SE through the ",[20,270,271],{},"Java SE Universal Subscription",", which is priced per employee rather than per installation. The count covers full-time, part-time and temporary staff, plus contractors who support internal operations, however few machines actually run Oracle Java.",[16,274,275,276,227],{},"So a handful of forgotten Oracle JDK installs can put your whole headcount in scope. For example, an organization of 5,000 employees running Oracle Java on 40 servers can face a list-price bill of around ",[20,277,278],{},"$630,000 a year",[16,280,281,282,286],{},"The free window is closing too. Oracle's No-Fee Terms and Conditions (NFTC) cover each LTS release only until one year after the next LTS ships. For Oracle JDK 21, that window ",[75,283,285],{"href":284},"\u002Farticles\u002Fjava-21-nftc-free-period-ended","closed on September 16, 2026",". Continuing to patch it now requires a paid subscription.",[288,289,290],"warning",{},[16,291,292],{},"We are not lawyers, and nothing here is legal advice. Licensing terms and prices change; check them against Oracle's current price list and your own agreements. Where a formal licensing position is needed, we work alongside independent licensing specialists.",[11,294,296],{"id":295},"what-we-do","What we do",[298,299,301],"h3",{"id":300},"_1-quantify-the-exposure","1. Quantify the exposure",[16,303,304,305,308],{},"Using the ",[75,306,307],{"href":253},"discovery inventory",", we identify every Oracle JDK and JRE, how it got there, and whether it is covered by another product's license. Then we put a number on what it costs you.",[298,310,312],{"id":311},"_2-decide-install-by-install","2. Decide, install by install",[16,314,315],{},"Most Oracle installs have no reason to be Oracle. A few do: vendor certification requirements or specific support needs. We make that call explicitly for each install instead of by default.",[298,317,319],{"id":318},"_3-migrate","3. Migrate",[16,321,322],{},"OpenJDK builds from Eclipse Adoptium (Temurin), Amazon (Corretto), Azul (Zulu), Red Hat and Microsoft are TCK-tested and free to use in production. For same-version swaps, migration is usually low risk, but not zero risk. We check for the known differences: truststore contents, installer paths and registry keys, fonts, and old commercial-feature flags. Then we roll out progressively.",[298,324,326],{"id":325},"_4-prove-it","4. Prove it",[16,328,329,330,334],{},"Uninstalling is not the same as re-pointing ",[331,332,333],"code",{},"JAVA_HOME",". We verify that Oracle binaries are actually gone and keep the evidence, which you will want if Oracle ever asks.",[11,336,338],{"id":337},"further-reading","Further reading",[35,340,341,346,352],{},[38,342,343],{},[75,344,345],{"href":284},"Oracle JDK 21's free update window has closed",[38,347,348],{},[75,349,351],{"href":350},"\u002Farticles\u002Foracle-java-employee-metric-explained","Oracle's employee-based Java pricing, explained",[38,353,354],{},[75,355,357],{"href":356},"\u002Farticles\u002Foracle-jdk-to-openjdk-migration-checklist","An Oracle JDK to OpenJDK migration checklist",{"title":229,"searchDepth":230,"depth":231,"links":359},[360,361,367],{"id":264,"depth":230,"text":265},{"id":295,"depth":230,"text":296,"children":362},[363,364,365,366],{"id":300,"depth":231,"text":301},{"id":311,"depth":231,"text":312},{"id":318,"depth":231,"text":319},{"id":325,"depth":231,"text":326},{"id":337,"depth":230,"text":338},"oracle-licensing","Quantify your Oracle Java SE exposure, then move every install that doesn't need Oracle onto a free, drop-in OpenJDK build, with evidence you can take to an audit or renewal.","Fixed-scope. We start from the discovery inventory, size your exposure, then migrate in waves. Low-criticality apps go first via Rapid Patch.","Often pays for itself","i-lucide-arrow-right-left",{},[375,376,377,378,379],"Your Oracle Java license exposure, in dollars, with the installs that drive it","A keep-or-migrate decision for every Oracle JDK install","Migration to Temurin, Corretto, Zulu, Red Hat or Microsoft builds of OpenJDK","Verified removal of Oracle binaries, with an evidence trail","Data to negotiate from ahead of an audit or renewal",{"title":259,"description":369},"services\u002Fopenjdk-migration","0aWf4Vd_7P0phaKwOWxq3bLjO4iX8gdRjDu_tPGAWBY",{"id":384,"title":216,"body":385,"category":488,"description":489,"engagement":490,"extension":241,"headline":491,"icon":492,"meta":493,"navigation":245,"order":231,"outcomes":494,"path":215,"seo":499,"stem":500,"__hash__":501},"services\u002Fservices\u002Frapid-patch.md",{"type":8,"value":386,"toc":482},[387,391,394,401,405,412,424,428,465,471,475],[11,388,390],{"id":389},"the-premise","The premise",[16,392,393],{},"Full regression testing before every JVM security patch is the main reason enterprise patch cycles take months. For business-critical systems that rigor is warranted. For the long tail of internal tools, batch jobs and low-traffic services it usually isn't. There it just delays the fix for a known CVE.",[16,395,396,397,400],{},"Rapid Patch ",[20,398,399],{},"does not skip testing",". It replaces pre-deployment regression testing with fast detection and fast rollback. If a bad patch is caught in minutes and reversed in minutes, running without an exhaustive test suite costs very little.",[11,402,404],{"id":403},"who-its-for","Who it's for",[16,406,407,408,411],{},"Applications that score below the critical threshold in our ",[75,409,410],{"href":77},"classification process",". This is a documented, weighted score with a named risk-acceptor, not an app owner's self-assessment. Apps near the threshold go to manual review.",[16,413,414,415,418,419,423],{},"Rapid Patch covers ",[20,416,417],{},"same-major security patches"," (for example 17.0.x to the next 17.0.x). Major version upgrades and vendor swaps are ",[75,420,422],{"href":421},"\u002Fapproach#patch-types","different engagements"," with a different risk profile.",[11,425,427],{"id":426},"how-it-works","How it works",[35,429,430,436,442,448,454],{},[38,431,432,435],{},[20,433,434],{},"Progressive rollout",": canary at 1%, then 10%, then 100%, gated on automated health checks",[38,437,438,441],{},[20,439,440],{},"Observability as the safety net",": error rates, latency, GC pause times, heap and thread behavior compared before and after the patch",[38,443,444,447],{},[20,445,446],{},"Fast, rehearsed rollback",": the previous runtime stays in place until the soak period ends, and rollback is exercised, not just written down",[38,449,450,453],{},[20,451,452],{},"Smoke tests and synthetic transactions"," for the paths that matter, in place of a full regression suite",[38,455,456,459,460,464],{},[20,457,458],{},"A pre-flight check"," for ",[75,461,463],{"href":462},"\u002Farticles\u002Fjvm-patch-failure-modes","known failure modes",": APM agents, TLS defaults, GC flags",[466,467,468],"tip",{},[16,469,470],{},"In many non-containerized estates, reliable rollback is the real gap. When that's the case we fix it first, because that step alone makes the patch cycle faster.",[11,472,474],{"id":473},"governance","Governance",[16,476,477,478],{},"Your Change Advisory Board approves the process once, as a standard change for a defined tier, instead of approving each patch. Every rollout produces evidence: which signals were checked, the results, timestamps, and who accepted the risk. ",[75,479,481],{"href":480},"\u002Farticles\u002Fcab-approval-for-faster-jvm-patching","How we get this past a CAB →",{"title":229,"searchDepth":230,"depth":231,"links":483},[484,485,486,487],{"id":389,"depth":230,"text":390},{"id":403,"depth":230,"text":404},{"id":426,"depth":230,"text":427},{"id":473,"depth":230,"text":474},"patch-management","Patch the long tail of non-business-critical Java apps in days, not quarters, by replacing full regression testing with progressive rollout, fast detection and rehearsed rollback.","Fixed-scope rollout of a patching pipeline and governance model for a defined tier of applications, followed by patch cycles run each quarter.","For non-critical apps","i-lucide-zap",{},[495,496,497,498],"Security patches applied across the tier in days after each quarterly release","Progressive rollout with automated health gates","A rollback path that has been tested, not just documented","A CAB-approved standard-change process and audit trail",{"title":216,"description":489},"services\u002Frapid-patch","qDIP1lgG0nnDOEyokq47L3LSfKbmYPHSlBnCXM3udLw",{"id":503,"title":221,"body":504,"category":588,"description":589,"engagement":590,"extension":241,"headline":591,"icon":592,"meta":593,"navigation":245,"order":594,"outcomes":595,"path":220,"seo":600,"stem":601,"__hash__":602},"services\u002Fservices\u002Fcritical-patch-assurance.md",{"type":8,"value":505,"toc":576},[506,510,517,523,527,531,534,538,541,545,548,552,555,559,562,566,569,573],[11,507,509],{"id":508},"a-different-promise","A different promise",[16,511,512,513,516],{},"For business-critical applications the value proposition flips. We aren't removing testing. We ",[20,514,515],{},"compress"," it so that each test cycle is shorter and gives you more confidence, and full rigor becomes possible on a faster cadence.",[16,518,519,520,522],{},"This is a different engagement from ",[75,521,216],{"href":215},", built on a different premise, not the same thing done more carefully.",[11,524,526],{"id":525},"whats-in-it","What's in it",[298,528,530],{"id":529},"test-impact-analysis-and-risk-based-test-selection","Test impact analysis and risk-based test selection",[16,532,533],{},"We use code coverage and change-impact analysis to find which of your existing regression tests actually exercise code paths affected by the JVM change, and run those on a compressed timeline. When the signal is ambiguous we escalate to the full suite.",[298,535,537],{"id":536},"shadow-traffic-and-dark-launch-testing","Shadow traffic and dark launch testing",[16,539,540],{},"We mirror real production traffic to a shadow instance running the patched JVM and diff its outputs against production, with no user exposure. This is the strongest \"test better, not less\" option available for critical services.",[298,542,544],{"id":543},"upgrade-readiness-assessment","Upgrade readiness assessment",[16,546,547],{},"Before any patch or upgrade, we scan for removed and deprecated API usage, known agent incompatibilities and dependency issues, and produce a risk report up front.",[298,549,551],{"id":550},"staging-and-production-parity-audits","Staging and production parity audits",[16,553,554],{},"Much critical-app patch risk comes from drift between staging and production, not from the patch itself. Closing that gap often gives you more than adding tests does.",[298,556,558],{"id":557},"canary-gates-on-business-metrics","Canary gates on business metrics",[16,560,561],{},"We go beyond latency and error rates to business invariants, such as transaction success rate, order completion and revenue per minute, and use them as automated rollback triggers.",[298,563,565],{"id":564},"patch-trains-and-war-room-support","Patch trains and war-room support",[16,567,568],{},"Scheduled, batched patch windows for critical apps, with dedicated live support during rollout, instead of ad hoc patching.",[298,570,572],{"id":571},"lts-aligned-strategy-and-vendor-coordination","LTS-aligned strategy and vendor coordination",[16,574,575],{},"Critical apps stay on designated LTS and security baselines, which keeps exposure windows short without constant churn. Where it matters, we work directly with your JVM vendor on compatibility and support commitments.",{"title":229,"searchDepth":230,"depth":231,"links":577},[578,579],{"id":508,"depth":230,"text":509},{"id":525,"depth":230,"text":526,"children":580},[581,582,583,584,585,586,587],{"id":529,"depth":231,"text":530},{"id":536,"depth":231,"text":537},{"id":543,"depth":231,"text":544},{"id":550,"depth":231,"text":551},{"id":557,"depth":231,"text":558},{"id":564,"depth":231,"text":565},{"id":571,"depth":231,"text":572},"risk-governance","For business-critical Java applications, we compress testing instead of removing it, so full rigor fits a faster patch cadence.","A higher-touch engagement for critical applications, typically starting with an upgrade-readiness assessment and continuing with scheduled patch trains.","For the apps that run the business","i-lucide-shield",{},4,[596,597,598,599],"Shorter test cycles for critical apps with the same or greater confidence","Shadow-traffic validation with no user exposure","Canary gates on business metrics, not just infrastructure metrics","Scheduled patch trains with live war-room support",{"title":221,"description":589},"services\u002Fcritical-patch-assurance","utoXA8F7946svO9yfDqjkPV5VtPJhDVhuelRoxSfZeU",{"id":604,"title":605,"body":606,"category":676,"description":677,"engagement":678,"extension":241,"headline":679,"icon":680,"meta":681,"navigation":245,"order":682,"outcomes":683,"path":689,"seo":690,"stem":691,"__hash__":692},"services\u002Fservices\u002Fthird-party-applications.md","Vendor & Third-Party Application JVMs",{"type":8,"value":607,"toc":672},[608,612,622,625,627,667],[11,609,611],{"id":610},"the-jvms-nobody-owns","The JVMs nobody owns",[16,613,614,615,618,619,227],{},"A large share of the Java in an enterprise wasn't written there. Application servers, database tooling, CI\u002FCD servers, monitoring agents, ETL tools, security appliances and desktop software often ship their ",[20,616,617],{},"own private JVM",", installed outside the package manager and invisible to anything that only checks the system ",[331,620,621],{},"java",[16,623,624],{},"These runtimes fall between two chairs. The platform team assumes the vendor patches them; the vendor assumes you'll apply their next release; the application owner assumes it's all fine. Meanwhile the bundled JVM ages.",[11,626,296],{"id":295},[35,628,629,639,645,655,661],{},[38,630,631,634,635,638],{},[20,632,633],{},"Find and attribute them."," ",[75,636,637],{"href":253},"Discovery"," surfaces bundled runtimes and ties each one to a product, version and business owner.",[38,640,641,644],{},[20,642,643],{},"Establish the supportability position."," For each product: does the vendor ship JVM updates, do they support replacing the bundled runtime, and which JDK builds do they certify?",[38,646,647,650,651,654],{},[20,648,649],{},"Patch what can be patched."," Through vendor updates or supported runtime swaps, rolled out with the same ",[75,652,653],{"href":215},"detection and rollback discipline"," as your own apps.",[38,656,657,660],{},[20,658,659],{},"Protect what can't."," Network isolation, disabling vulnerable features, tighter access. The compensating controls are documented so your risk register reflects reality.",[38,662,663,666],{},[20,664,665],{},"Take it to the vendor."," Certified-JDK questions, SBOM requests and patch-timeline commitments, backed by the specific evidence you need for a contract conversation.",[84,668,669],{},[16,670,671],{},"Some commercial products include a restricted Oracle Java license for use with that product only. Whether a bundled Oracle runtime creates licensing exposure depends on the product's terms, so we check them rather than assuming either way.",{"title":229,"searchDepth":230,"depth":231,"links":673},[674,675],{"id":610,"depth":230,"text":611},{"id":295,"depth":230,"text":296},"third-party-apps","Advisory for the Java you don't build yourself, including commercial products, appliances and vendor-bundled runtimes, so they get patched or protected instead of forgotten.","Advisory engagement scoped per vendor portfolio, usually following a discovery engagement that surfaces the bundled runtimes.","Second- and third-party apps","i-lucide-package",{},5,[684,685,686,687],"Every vendor-bundled JVM identified and attributed to a product and owner","A supportability position for each (vendor update, supported JRE swap or neither)","Compensating controls where patching isn't possible",{"Vendor asks backed by evidence":688},"certified JDKs, SBOMs, patch timelines","\u002Fservices\u002Fthird-party-applications",{"title":605,"description":677},"services\u002Fthird-party-applications","oy1ThKLwcn-G3Z5DaUWp8Maj1EXsbbInm5duRfzyfRs",{"id":694,"title":196,"body":695,"category":238,"description":763,"engagement":764,"extension":241,"headline":202,"icon":765,"meta":766,"navigation":245,"order":767,"outcomes":768,"path":195,"seo":773,"stem":774,"__hash__":775},"services\u002Fservices\u002Fdrift-monitoring.md",{"type":8,"value":696,"toc":758},[697,701,704,707,711,747,751],[11,698,700],{"id":699},"assessments-go-stale","Assessments go stale",[16,702,703],{},"An estate assessment is accurate the day it's delivered. After that, teams deploy new services, vendors ship updates with new bundled runtimes, someone installs Oracle JDK on a build agent, and a new CVE lands against a version you thought was fine.",[16,705,706],{},"Continuous Drift Monitoring keeps the picture current. The inventory becomes a system of record instead of a PDF.",[11,708,710],{"id":709},"what-it-watches","What it watches",[35,712,713,719,725,731,737],{},[38,714,715,718],{},[20,716,717],{},"New and undocumented JVMs"," across hosts, containers and artifact repositories",[38,720,721,724],{},[20,722,723],{},"Patch-level drift",": which runtimes fell behind after each quarterly critical patch update",[38,726,727,730],{},[20,728,729],{},"New CVEs"," against the versions and dependencies you actually run",[38,732,733,736],{},[20,734,735],{},"License exposure changes",": a new Oracle JDK install is flagged before it shows up in an audit",[38,738,739,742,743,746],{},[20,740,741],{},"Classification triggers",", such as a new regulated data flow, a traffic spike or an incident, which force an application's ",[75,744,745],{"href":77},"risk tier"," to be re-scored",[11,748,750],{"id":749},"how-its-delivered","How it's delivered",[16,752,753,754,757],{},"Collection reuses the minimum-privilege methods from the ",[75,755,756],{"href":253},"original assessment",". Findings go to a shared dashboard and to the channels your teams already use. Each quarter, aligned to the Java patch calendar, we review drift, exposure and upcoming end-of-life dates with you.",{"title":229,"searchDepth":230,"depth":231,"links":759},[760,761,762],{"id":699,"depth":230,"text":700},{"id":709,"depth":230,"text":710},{"id":749,"depth":230,"text":750},"Keep your JVM inventory, patch posture and Oracle license exposure current as the estate changes, instead of commissioning a new assessment every year.","Ongoing subscription after an estate assessment. Continuous collection, alerting on meaningful changes, and a quarterly review aligned to the Java patch calendar.","i-lucide-refresh-cw",{},6,[769,770,771,772],"New and undocumented JVMs detected as they appear","Patch-level drift tracked against each quarterly release","Alerts when a new install creates Oracle license exposure","Automatic re-classification when an app's risk profile changes",{"title":196,"description":763},"services\u002Fdrift-monitoring","Phmhi-GcB9IZ5dN4HFjsW_dg9QF_D9rXUNzILnRNAKE",{"id":604,"title":605,"body":777,"category":676,"description":677,"engagement":678,"extension":241,"headline":679,"icon":680,"meta":825,"navigation":245,"order":682,"outcomes":826,"path":689,"seo":828,"stem":691,"__hash__":692},{"type":8,"value":778,"toc":821},[779,781,787,789,791,817],[11,780,611],{"id":610},[16,782,614,783,618,785,227],{},[20,784,617],{},[331,786,621],{},[16,788,624],{},[11,790,296],{"id":295},[35,792,793,799,803,809,813],{},[38,794,795,634,797,638],{},[20,796,633],{},[75,798,637],{"href":253},[38,800,801,644],{},[20,802,643],{},[38,804,805,650,807,654],{},[20,806,649],{},[75,808,653],{"href":215},[38,810,811,660],{},[20,812,659],{},[38,814,815,666],{},[20,816,665],{},[84,818,819],{},[16,820,671],{},{"title":229,"searchDepth":230,"depth":231,"links":822},[823,824],{"id":610,"depth":230,"text":611},{"id":295,"depth":230,"text":296},{},[684,685,686,827],{"Vendor asks backed by evidence":688},{"title":605,"description":677},[830],{"id":831,"title":832,"author":833,"body":834,"category":676,"date":1219,"description":1220,"draft":1221,"extension":241,"featured":1221,"image":1222,"meta":1223,"navigation":245,"path":1224,"readingTime":682,"seo":1225,"stem":1226,"tags":1227,"updated":1222,"__hash__":1232},"articles\u002Farticles\u002Fpatching-jvms-inside-vendor-products.md","Patching the JVMs you didn't install: Java inside vendor products","patchmageddon-team",{"type":8,"value":835,"toc":1205},[836,839,842,846,849,899,902,906,916,933,936,969,973,979,982,1043,1054,1058,1062,1065,1069,1072,1076,1079,1105,1111,1115,1118,1136,1140,1143,1150,1153,1163,1168,1172,1175,1190,1194],[16,837,838],{},"When security teams talk about \"patching Java,\" they usually mean the JDKs their own engineers install: the runtime on the standard server build, the base container image, the app-server installation. Those matter, and they're the easy part.",[16,840,841],{},"The harder part is the Java that arrived inside something else. A large share of the JVMs in a typical enterprise were never installed as Java at all. They came bundled inside a commercial product, an appliance, a build tool or a desktop application, each with its own runtime, update schedule and support rules.",[11,843,845],{"id":844},"where-bundled-jvms-hide","Where bundled JVMs hide",[16,847,848],{},"Common places we find private Java runtimes:",[35,850,851,857,863,869,875,881,887,893],{},[38,852,853,856],{},[20,854,855],{},"Application servers and middleware"," installed from vendor media, which often include their own JDK.",[38,858,859,862],{},[20,860,861],{},"Database and data-platform tooling",": management consoles, client tools, ETL and integration products.",[38,864,865,868],{},[20,866,867],{},"Search and analytics engines."," Some ship with a bundled JDK by default. Elasticsearch is a well-known example.",[38,870,871,874],{},[20,872,873],{},"CI\u002FCD and developer tooling",": build agents, artifact repositories and IDEs that bundle their own runtime.",[38,876,877,880],{},[20,878,879],{},"Monitoring, backup and security products",": collectors, agents and management servers.",[38,882,883,886],{},[20,884,885],{},"Collaboration and ticketing platforms"," whose installers include a JRE.",[38,888,889,892],{},[20,890,891],{},"Network and storage appliances",", virtual or physical, with management interfaces written in Java.",[38,894,895,898],{},[20,896,897],{},"Desktop applications"," that bundle a private JRE to avoid depending on the system Java.",[16,900,901],{},"Each of these has a runtime that's often several updates behind, sometimes a full major version behind, and owned in practice by nobody.",[11,903,905],{"id":904},"why-your-scanners-miss-them","Why your scanners miss them",[16,907,908,909,911,912,915],{},"Most inventory and vulnerability tools find Java by asking the operating system: the package manager, the Windows installed-programs list, or the ",[331,910,621],{}," on the ",[331,913,914],{},"PATH",". Bundled runtimes usually bypass all three:",[35,917,918,921,927,930],{},[38,919,920],{},"They're unpacked into the product's own directory, not installed as a package.",[38,922,923,924,926],{},"They're not on the ",[331,925,914],{},", because only the product's launcher uses them.",[38,928,929],{},"Their version may not appear in any registry or package database.",[38,931,932],{},"In containers, the JDK is a layer inside a vendor image you pull, not something you install.",[16,934,935],{},"Some scanners do file-system or running-process checks and catch more. Even then, results are often reported as \"Java vulnerability on host X\" with no link to the product that owns the runtime. That leaves the ticket with nowhere useful to go.",[16,937,938,939,942,943,946,947,950,951,954,955,957,958,954,961,964,965,227],{},"Good discovery looks at ",[20,940,941],{},"running processes",", the ",[20,944,945],{},"file system"," (for ",[331,948,949],{},"release"," files, ",[331,952,953],{},"libjvm"," and ",[331,956,621],{}," binaries outside standard locations), ",[20,959,960],{},"container images",[20,962,963],{},"artifact repositories",". It then ties each runtime back to the product and owner responsible for it. We describe that approach in ",[75,966,968],{"href":967},"\u002Farticles\u002Ffinding-every-jvm-in-your-estate","finding every JVM in your estate",[11,970,972],{"id":971},"the-supportability-question","The supportability question",[16,974,975,976],{},"Once you've found an outdated bundled runtime, the obvious fix is to replace it with a patched JDK. Before you do, ask: ",[20,977,978],{},"will the vendor still support the product if you do?",[16,980,981],{},"Vendors fall into roughly four groups:",[130,983,984,997],{},[133,985,986],{},[136,987,988,991,994],{},[139,989,990],{},"Vendor position",[139,992,993],{},"What it means",[139,995,996],{},"Typical action",[152,998,999,1010,1021,1032],{},[136,1000,1001,1004,1007],{},[157,1002,1003],{},"Ships runtime updates with product patches",[157,1005,1006],{},"The JVM is patched when you patch the product",[157,1008,1009],{},"Keep the product current; track the lag between Java CPUs and vendor releases",[136,1011,1012,1015,1018],{},[157,1013,1014],{},"Documents a supported JRE swap",[157,1016,1017],{},"You may point the product at a newer JDK within stated limits",[157,1019,1020],{},"Swap within the certified versions; keep evidence of the support statement",[136,1022,1023,1026,1029],{},[157,1024,1025],{},"Certifies specific versions only",[157,1027,1028],{},"Other runtimes may work but are unsupported",[157,1030,1031],{},"Ask for an updated certification; weigh the risk of running unsupported",[136,1033,1034,1037,1040],{},[157,1035,1036],{},"Silent or refuses",[157,1038,1039],{},"No guidance, or runtime changes void support",[157,1041,1042],{},"Use compensating controls and escalate commercially",[16,1044,1045,1046,1049,1050,1053],{},"Check the product's ",[20,1047,1048],{},"certification matrix"," or supported-platforms documentation. Where it's silent, ask the vendor directly and ",[20,1051,1052],{},"get the answer in writing",". \"Support told us on a call that it's fine\" won't help much when an incident review asks why the runtime was changed.",[11,1055,1057],{"id":1056},"your-options-in-order-of-preference","Your options, in order of preference",[298,1059,1061],{"id":1060},"_1-take-the-vendors-update","1. Take the vendor's update",[16,1063,1064],{},"If the vendor ships the patched runtime as part of a product release, upgrading the product is the supported path. Measure how long the vendor takes to ship Java CPU fixes. A vendor that routinely lags two or three quarters behind the Java security schedule is a risk worth raising at renewal.",[298,1066,1068],{"id":1067},"_2-do-a-supported-runtime-replacement","2. Do a supported runtime replacement",[16,1070,1071],{},"If the vendor documents how to use an external or newer JDK, do it within those limits. Treat it like any other JVM patch: smoke test, canary where possible and keep a rollback. Remember that the product's next upgrade may silently restore its bundled runtime, so re-check after every product update.",[298,1073,1075],{"id":1074},"_3-apply-compensating-controls","3. Apply compensating controls",[16,1077,1078],{},"When you can't patch the runtime without losing support, reduce the exposure instead:",[35,1080,1081,1087,1093,1099],{},[38,1082,1083,1086],{},[20,1084,1085],{},"Network isolation."," Restrict who and what can reach the product, especially management interfaces.",[38,1088,1089,1092],{},[20,1090,1091],{},"Disable unused features"," that expose vulnerable code paths, such as remote management, deserialization endpoints or unused protocols.",[38,1094,1095,1098],{},[20,1096,1097],{},"Tighten TLS and authentication"," at a proxy or load balancer in front of the product.",[38,1100,1101,1104],{},[20,1102,1103],{},"Increase monitoring"," on the host, and document the accepted risk with a named owner and a review date.",[16,1106,1107,1108,227],{},"Compensating controls are a legitimate risk decision, but they should be recorded as one, not left as an undocumented exception. The governance side is covered in ",[75,1109,1110],{"href":480},"getting faster JVM patching approved by your CAB",[298,1112,1114],{"id":1113},"_4-use-commercial-pressure","4. Use commercial pressure",[16,1116,1117],{},"Vendors respond to contract terms more reliably than to support tickets. At renewal or in new contracts, consider asking for:",[35,1119,1120,1123,1130,1133],{},[38,1121,1122],{},"A commitment to ship Java security updates within a defined window after each quarterly CPU.",[38,1124,1125,1126,1129],{},"A ",[20,1127,1128],{},"software bill of materials (SBOM)"," that lists the bundled runtime, version and vendor.",[38,1131,1132],{},"A documented, supported procedure for replacing the bundled runtime.",[38,1134,1135],{},"Support for current LTS Java releases within a reasonable period after release.",[11,1137,1139],{"id":1138},"the-oracle-licensing-nuance","The Oracle licensing nuance",[16,1141,1142],{},"Bundled runtimes also complicate Oracle Java licensing, in both directions.",[16,1144,1145,1146,1149],{},"Some commercial products, including some Oracle products and some third-party products, include a Java SE license that's ",[20,1147,1148],{},"restricted to running that product",". An Oracle JDK bundled that way may not create exposure by itself, but it generally doesn't allow general-purpose use by other applications on the same machine.",[16,1151,1152],{},"The opposite also happens. A product may have been installed with an Oracle JDK that someone downloaded separately, with no licensing coverage from the product vendor at all.",[16,1154,1155,1156,1159,1160,227],{},"So don't assume either way. For each bundled Oracle runtime, check the product's license terms and record the conclusion. This matters because of ",[75,1157,1158],{"href":350},"how Oracle's employee-based Java metric works",": one uncovered install can put the whole organization in scope. For the timing pressure on JDK 21 in particular, see ",[75,1161,1162],{"href":284},"what the end of the free update window means",[84,1164,1165],{},[16,1166,1167],{},"Licensing conclusions depend on specific contract wording. This article is not legal advice. Confirm with your licensing team and the product vendor.",[11,1169,1171],{"id":1170},"making-it-sustainable","Making it sustainable",[16,1173,1174],{},"Bundled runtimes don't stay fixed. Products get upgraded, reinstalled and replaced, and each change can bring a different runtime. The practical approach:",[1176,1177,1178,1181,1184,1187],"ol",{},[38,1179,1180],{},"Keep the inventory of bundled runtimes linked to products and owners.",[38,1182,1183],{},"Track each product's Java update lag against the quarterly CPU calendar.",[38,1185,1186],{},"Record the support position and license position per product.",[38,1188,1189],{},"Re-scan continuously, not once a year, so a product upgrade that restores an old runtime gets noticed.",[11,1191,1193],{"id":1192},"what-to-do-next","What to do next",[16,1195,1196,1197,1200,1201,1204],{},"Our ",[75,1198,1199],{"href":689},"third-party application advisory"," works through bundled runtimes product by product, from support position to vendor escalation. ",[75,1202,1203],{"href":195},"Continuous drift monitoring"," catches it when a product upgrade quietly brings an old JVM back.",{"title":229,"searchDepth":230,"depth":231,"links":1206},[1207,1208,1209,1210,1216,1217,1218],{"id":844,"depth":230,"text":845},{"id":904,"depth":230,"text":905},{"id":971,"depth":230,"text":972},{"id":1056,"depth":230,"text":1057,"children":1211},[1212,1213,1214,1215],{"id":1060,"depth":231,"text":1061},{"id":1067,"depth":231,"text":1068},{"id":1074,"depth":231,"text":1075},{"id":1113,"depth":231,"text":1114},{"id":1138,"depth":230,"text":1139},{"id":1170,"depth":230,"text":1171},{"id":1192,"depth":230,"text":1193},"2026-08-04","Many commercial products ship their own Java runtime. Why scanners miss them, what vendors will support, and how to handle the ones you can't patch yourself.",false,null,{},"\u002Farticles\u002Fpatching-jvms-inside-vendor-products",{"title":832,"description":1220},"articles\u002Fpatching-jvms-inside-vendor-products",[676,1228,1229,1230,1231],"vendor-management","jvm-inventory","patching","sbom","evxCmQkEaWsBhnvnceMe-gfG8-h4zN5-9uZZdsr7ioM",[1234,1235],{"title":221,"path":220,"stem":601,"description":589,"children":-1},{"title":196,"path":195,"stem":774,"description":763,"children":-1},1790355850053]