Critical Vulnerabilities detected on Oracle Java and Azul Zulu

Multiple vulnerabilities have been identified in both Oracle Java and Azul Zulu distributions across various JDK and JRE versions. These flaws could allow attackers to execute arbitrary code, escalate privileges, or cause denial-of-service conditions. Systems running outdated or unpatched Java environments are particularly at risk. Oracle has released fixes for several of these issues as part of its April 2026 Critical Patch Update, while some vulnerabilities in Azul Zulu are currently documented without corresponding patches. Applying available updates and monitoring vendor advisories is essential to secure affected Java deployments. Below are the vulnerability details:

S.No	CVEs	Patch Description	Patch ID	Bulletin ID	Reference
1	CVE-2026-20652, CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-34268, CVE-2026-34282	Java SE Development Kit (x64) 8.0.4910.10	358379	TU-160	https://www.oracle.com/security-alerts/cpuapr2026.html
2	CVE-2026-20652, CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-34268, CVE-2026-34282	Java SE Development Kit 8.0.4910.10	358381	TU-160	https://www.oracle.com/security-alerts/cpuapr2026.html
3	CVE-2026-20652, CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-34268, CVE-2026-34282	Java Runtime Environment 1.8 (x64) 8.0.4910.10	358378	TU-053	https://www.oracle.com/security-alerts/cpuapr2026.html
4	CVE-2026-20652, CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-34268, CVE-2026-34282	Java Runtime Environment 1.8 8.0.4910.10	358377	TU-053	https://www.oracle.com/security-alerts/cpuapr2026.html
5	CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-34268, CVE-2026-34282	NA	NA	NA	https://docs.azul.com/core/cve
6	CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-34268, CVE-2026-34282	Java SE Development Kit 25 (x64) 25.0.3	358344	TU-2128	https://www.oracle.com/security-alerts/cpuapr2026.html
7	CVE-2026-22008	JDK 25 (x64) 25.0.2 / 25.0.3	355210, 358344	TU-2128	https://www.oracle.com/security-alerts/cpuapr2026.html
8	CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-34268, CVE-2026-34282	JDK 21 (x64) 21.0.11	358343	TU-1553	https://www.oracle.com/security-alerts/cpuapr2026.html
9	CVE-2026-20652, CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-34268	NA	NA	NA	https://docs.azul.com/core/cve
10	CVE-2026-20652, CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-34268	NA	NA	NA	https://docs.azul.com/core/cve
11	CVE-2026-20652, CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-34268, CVE-2026-34282	NA	NA	NA	https://docs.azul.com/core/cve
12	CVE-2026-20652, CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-34268, CVE-2026-34282	NA	NA	NA	https://docs.azul.com/core/cve
13	CVE-2026-20652, CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-34268, CVE-2026-34282	NA	NA	NA	https://docs.azul.com/core/cve
14	CVE-2026-20652, CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-34268, CVE-2026-34282	NA	NA	NA	https://docs.azul.com/core/cve
15	CVE-2026-20652, CVE-2026-22007, CVE-2026-22008, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-34268, CVE-2026-34282	NA	NA	NA	https://docs.azul.com/core/cve
16	CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-34268, CVE-2026-34282	JDK 11 (64-bit) 11.0.31	358388	TU-802	https://www.oracle.com/security-alerts/cpuapr2026.html
17	CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22018, CVE-2026-22021, CVE-2026-23865, CVE-2026-34268, CVE-2026-34282	JDK 17 17.0.19	358380	TU-1282	https://www.oracle.com/security-alerts/cpuapr2026.html

Immediately deploy patches for vulnerabilities where fixes are available. To patch the vulnerabilities using Vulnerability Manager Plus, initiate a database sync between the Vulnerability Manager Plus server and the Central Patch repository and search for these Patch IDs or Bulletin ID. Select the patches and deploy them to your target machines. For vulnerabilities where patches have not yet been released, it is recommended to continuously monitor vendor advisories, apply available mitigations or workarounds, and restrict exposure by limiting access to affected applications until official fixes become available.

Cheers,

ManageEngine Team