# Azul Ships Security-Only Update for All 53 OpenJDK Flaws, a Decade High

> Azul released security-only updates for Azul Core addressing all 53 OpenJDK vulnerabilities, a count 7x the two-year average of 7.6 CVEs per quarter.

- Published: 2026-10-20T21:48:41+00:00
- Section: Product Launches
- Author: News Desk
- URL: https://newsforagent.com/news/2026-10-20/azul-openjdk-security-update-53-vulnerabilities
- Source: [Business Wire](https://www.businesswire.com/news/home/20261020790861/en/)

## Key takeaways

- Azul released October Security-only, Stability-first updates for Azul Core addressing all 53 vulnerabilities in the latest OpenJDK quarterly update.
- The 53 vulnerabilities are 7x the two-year average of 7.6 CVEs per quarter and the most in a single update in well over a decade.
- Azul said mean time to exploit has shrunk to -7 days while the median enterprise patch cycle is 43 days.

[Azul](https://akta.pro/company-profiles/0005n2o/azul-systems) released its October Security-only, Stability-first updates for Azul Core on October 20, 2026, addressing all 53 vulnerabilities disclosed in the latest OpenJDK quarterly update. The count is 7x the two-year average of 7.6 Common Vulnerabilities and Exposures per quarter, [Business Wire](https://www.businesswire.com/news/home/20261020790861/en/) reported.

## Azul Core's Security-Only October Release

The updates contain security fixes and nothing else, with no new features, enhancements or unrelated changes, according to the company. Azul said the updates are immediately deployable to production. OpenJDK quarterly updates that include fixes for these CVEs also include more than 150 code changes unrelated to security, the company said.

Azul said it is the only vendor to offer both monthly and quarterly updates scoped to just security fixes. The company also delivers monthly Stability-first Critical Security Patch Updates layered on the existing security-only quarterly update, a capability it said no other Java vendor or OpenJDK distribution offers. Azul Core is a Java SE-compliant build of OpenJDK certified with the Technology Compatibility Kit and a drop-in replacement for Oracle Java and other Java SE-compliant distributions. Subscribers get monthly and quarterly security-only updates, quarterly full updates and out-of-cycle fixes for every LTS release: 8, 11, 17, 21 and 25. Azul also provides backported security fixes for Java 6 and 7.

"The record number of vulnerabilities in one OpenJDK update is a very real warning to all enterprises running their business-critical workloads on Java," said Scott Sellers, co-founder and CEO of Azul. "Enterprises shouldn't have to choose between security and stability."

## Azul's Record on Java Security Fixes

According to [akta.pro company records](https://akta.pro/company-data), Azul launched a free JVM Vulnerability Risk Assessment tool in June 2026 to give enterprises visibility into Java runtime security gaps and prioritized remediation roadmaps. In March 2026, Azul joined Chainguard's Commercial Builds program alongside Elastic, GitLab and Grafana Labs to deliver secure Java container images with zero known vulnerabilities, full provenance and defined CVE SLAs. Azul acquired Payara, a Jakarta EE solutions provider, in December 2025.

## Earlier Azul Security and Product Moves

In July 2026, Azul announced it would deliver monthly Critical Security Patch Updates for Java Long-Term Support versions starting August 2026, shifting from its traditional quarterly cadence, FinancialContent Business Page reported. In June 2026, Azul introduced a free vulnerability risk assessment for Java Virtual Machines to help organizations identify security blind spots that autonomous AI-powered exploitation tools can discover, InfoWorld reported. In October 2026, Azul added a feature to Azul Prime that cuts Java application warm-up times by 2x to 5x compared with standard OpenJDK, Channellife reported.

## Where to Get the October Update

Azul said resellers and security services delivery partners can take the October update to security-conscious customers now, with resale and services included in current Azul Core channel pricing. Enterprises running Oracle Java, other OpenJDK builds or free Azul Zulu builds in production can get patched with Azul, the company said.

## Companies in this story

- [Azul Systems company profile](https://akta.pro/company-profiles/0005n2o/azul-systems) · website: http://www.azul.com

---
News for Agent · https://newsforagent.com/llms.txt