Azul Shows That Mean Time to Exploit Java Vulnerabilities Drops to Five Days

Audio By Carbonatix

SUNNYVALE, Calif.--(BUSINESS WIRE)--Mar 31, 2026--

Azul, the trusted leader in enterprise Java for today’s AI and cloud-first world, today highlighted growing security risks for enterprises relying on free, unsupported Java runtimes. Azul demonstrated how the accelerating speed of vulnerability exploitation, combined with slow enterprise patch cycles, is creating a widening window of exposure for organizations without commercial Java support.

Java averages 10-12 vulnerabilities per quarterly update. In 2018, attackers needed 32 days to exploit a disclosed vulnerability. By 2023, that dropped to five days. Cloudflare reported one case where exploitation occurred in 22 minutes.

Yet enterprises average 60 to 150 days to remediate a vulnerability. For organizations running free Java distributions, there is no guaranteed access to timely fixes. Azul is the only Java provider other than Oracle that delivers Critical Set Updates (CSUs), security-only patches that deploy faster with less regression risk than full Patch Set Updates.

To learn more, watch The True Cost of Free Java Runtimes webinar series.

FAQs

How quickly are Java vulnerabilities exploited after disclosure?

Mean time to exploit dropped from 32 days in 2018 to five days in 2023. Organizations on unsupported Java runtimes face growing exposure as attackers use AI-assisted tools to accelerate exploitation.

What is a Critical Set Update (CSU) for Java?

Unlike a full Patch Set Update, a CSU contains only the security fix, enabling faster deployment with less regression risk. Azul is the only provider other than Oracle that delivers CSUs.

What are the compliance risks of running unsupported Java in production?

GDPR requires breach notification within 72 hours. With remediation averaging 60 to 150 days, organizations without commercial support face a significant gap between regulatory requirements and their ability to respond.

About Azul

Azul is the trusted leader in enterprise Java for today’s AI and cloud-first world. Its open source-based Java platform empowers organizations to optimize the entire Java lifecycle to accelerate performance, strengthen security, reduce licensing and cloud costs, and boost developer productivity. Azul powers mission-critical systems for 36% of the Fortune 100, 50% of the Forbes Top 10 World’s Most Valuable Brands, and the world’s top 10 financial trading companies. Learn more at azul.com and follow @azulsystems.​

View source version on businesswire.com:https://www.businesswire.com/news/home/20260331689253/en/

CONTACT: Media Contact for Azul:

Treble

Josh Georgiou

[email protected]

KEYWORD: CALIFORNIA UNITED STATES NORTH AMERICA

INDUSTRY KEYWORD: DATA MANAGEMENT SECURITY TECHNOLOGY SOFTWARE NETWORKS ARTIFICIAL INTELLIGENCE INTERNET

SOURCE: Azul

Copyright Business Wire 2026.

PUB: 03/31/2026 09:00 AM/DISC: 03/31/2026 09:00 AM

http://www.businesswire.com/news/home/20260331689253/en