Azul has released security updates for all 53 vulnerabilities disclosed in the latest quarterly OpenJDK update, the highest total in a single OpenJDK release in more than a decade.
Its latest Azul Core release is limited to security fixes, unlike standard OpenJDK quarterly updates, which also include unrelated code changes. Azul said the broader OpenJDK release contains more than 150 non-security code changes alongside fixes for the newly disclosed Common Vulnerabilities and Exposures.
The disclosure count is also well above the recent norm. Azul said the 53 vulnerabilities are seven times the two-year quarterly average of 7.6 CVEs, highlighting a heavier patching burden for organisations running Java-based systems.
AI pressure
The announcement comes amid broader concern that artificial intelligence is reducing the time attackers need to identify and exploit weaknesses in widely used software. Azul pointed to recent public examples in which AI tools were used to uncover or chain vulnerabilities far faster than traditional attack methods.
In one case, researchers used an AI tool to find a 13-year-old remote code execution flaw in Apache ActiveMQ in about 10 minutes. In another, GreyNoise documented a suspected attacker using hundreds of AI agents to chain two zero-day flaws in PaperCut NG/MF, moving from an empty workspace to remote code execution in under four hours.
Azul said the risk for Java users is heightened by the mismatch between exploitation speed and patching cycles in many organisations. It cited industry data showing a median enterprise patch cycle of 43 days, while mean time to exploit has fallen to minus seven days, meaning attacks can begin before a patch is available.
Its analysis of the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue found that 61% of vulnerabilities published in 2025 and later exploited were added to the list within 30 days of public disclosure. Azul added that the true proportion is likely higher because the figure excludes vulnerabilities already under exploitation at or before disclosure.
Patch stability
A central issue for software teams is whether urgent security fixes can be rolled out without disrupting live systems. Azul argues this is harder when OpenJDK updates combine security patches with bug fixes, enhancements and other code changes that may introduce regressions.
More than 20% of OpenJDK quarterly updates since 2020 have included regressions that delayed roll-outs, according to Azul. It cited past examples that it said broke application access to Google APIs, corrupted Tomcat HTTP content and disrupted Hadoop deployments.
By contrast, Azul said its security-only updates are built on the previous quarter's stabilised full patch update and contain no new features or unrelated bug fixes. The narrower scope is intended to reduce the risk of deployment problems in production environments that depend on Java for critical applications.
Azul also offers monthly and out-of-cycle security updates in addition to quarterly releases. It described itself as the only vendor providing both monthly and quarterly OpenJDK updates limited to security fixes.
Older Java versions
The update also highlights older Java estates still running in production. Many large organisations continue to use Java 6 and Java 7 in legacy environments, and Azul said it provides backported security fixes for those versions as well as for long-term support releases including 8, 11, 17, 21 and 25.
That matters because older installations can be harder to replace quickly, especially in sectors with long-lived systems such as finance, government and industrial operations. For those users, the challenge is not only identifying exposures but also applying fixes without causing instability in applications that may have been running unchanged for years.
Azul positions Azul Core as a Java SE-compliant build of OpenJDK and a drop-in replacement for Oracle Java and other Java SE-compliant distributions. Subscribers receive monthly and quarterly security-only updates, quarterly full updates and out-of-cycle fixes when required.
Scott Sellers, Co-Founder and Chief Executive Officer at Azul, said the latest vulnerability count should serve as a warning for companies relying on Java across core operations. "The record number of vulnerabilities in one OpenJDK update is a very real warning to all enterprises running their business-critical workloads on Java. AI has collapsed the time between disclosure and exploitation from weeks to days to hours, and attackers are chaining flaws that defenders used to rank as low priority," Sellers said.
"Enterprises shouldn't have to choose between security and stability. Azul's Security-only, Stability-first updates are able to be deployed immediately, so customers can close the exposure window before an attacker finds it first," he said.