Is Java safe right now?
No Java flaws have been added to CISA's exploited list in the last 90 days (the most recent was May 12, 2023). Keep automatic updates on: that can change any day.
Earlier exploited flaws
- Oracle Java SE and JRockit Unspecified Vulnerability
- Oracle JRE Unspecified Vulnerability
- Oracle JRE Sandbox Bypass Vulnerability
- Oracle JRE Remote Code Execution Vulnerability
- Oracle JRE Unspecified Vulnerability
- Oracle Java SE Unspecified Vulnerability
- Oracle Java SE Sandbox Bypass Vulnerability
- Oracle Java SE Integrity Check Vulnerability
- Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
- Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
- Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
- Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
- Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
By year
| Year | Exploited flaws added | Zero-days |
|---|---|---|
| 2026 (so far) | 0 | 0 |
| 2025 | 0 | 0 |
| 2024 | 0 | 0 |
| 2023 | 1 | 0 |
| 2022 | 12 | 0 |
Questions
Is Java safe right now?
No Java flaws have been added to CISA's exploited list in the last 90 days (the most recent was May 12, 2023). Keep automatic updates on: that can change any day. Confirm with the vendor's own advisories and install updates as soon as they're available.
How many Java vulnerabilities have been exploited?
13 flaws are on CISA's list of vulnerabilities known to be exploited in real attacks, 6 of them used by ransomware.
Covers products matching java se, oracle java, jre, jdk. Sources: CISA's Known Exploited Vulnerabilities catalog and the vendors' own advisories. Updated every hour. General information only; confirm details with the vendor.