Azul, the trusted leader in enterprise Java for today’s AI-first world, today released the 2026 AI Vulnerability Gap Report, a survey of 300 U.S. security leaders at organizations where Java is a significant share of the production application estate, conducted independently by Censuswide. The report finds that 85% of organizations have already experienced an incident, a suspected incident or near miss attributable to slow patching, including 55% who report a confirmed incident and 53% who report a near miss, as AI shrinks the time attackers need to exploit newly disclosed vulnerabilities.

This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20261110230514/en/

Key Findings from Azul's 2026 AI Vulnerability Gap Report

Key Findings from Azul’s 2026 AI Vulnerability Gap Report

Same Defenses, Faster Attackers

The findings arrive weeks after October’s OpenJDK quarterly update disclosed a record 53 OpenJDK vulnerabilities, the most in a single update in well over a decade, at a time when exploitation is outpacing patching. Virtually every leader surveyed said AI-powered attack tools have increased their organization’s security exposure over the past 12 months, yet 59% have not changed their security posture: 34% describe a moderate increase and are reassessing, while 25% say the increase is slight and not a priority. Meanwhile, 69% believe AI-equipped attackers can build a working exploit within three days or less, including 47% who say one to three days and 22% who say less than 24 hours. Mandiant’s M-Trends 2026 report goes further, estimating that the mean time to exploit dropped to negative seven days in 2025, meaning exploitation is often routinely occurring before a patch is even released.

The Patch Cycle Was Designed for a Different Adversary

Only 13% of security leaders say their organization can deploy a patch for a critical vulnerability across production in under 24 hours, while 43% need one to three days, 32% need four to six days and 12% need longer. In other words, the report finds a three-day gap: 69% of leaders believe an attacker can build a working exploit within three days, but only 56% of their organizations can get a critical fix out in that time. The same gap shows up at the 24-hour mark: 22% believe attackers are already working inside that window, but only 13% say they can deploy that fast.

Testing is a major reason. Asked how long pre-deployment testing adds to their patch cycle for Java runtime updates, 36% said four to six days, 33% said one to three days and 22% said a week or more; only 9% said less than 24 hours, and no respondent skips testing. In total, 58% of organizations add four or more days of testing alone, longer than the three days or less most leaders believe an attacker needs.

The testing burden exists because most Java updates carry more than security fixes. A full OpenJDK quarterly update can include hundreds of non-security code changes alongside the security fixes, and according to Azul’s assessment of OpenJDK releases over the past six-plus years, 23% of quarterly updates (6 of 26) caused a serious regression. That leaves enterprises with a significant challenge of trading off security vs. stability.

85% Have Already Had an Incident or Near Miss

The cost of slow patching is no longer hypothetical. Fifty-five percent of security leaders report a confirmed incident and 53% report a near miss attributable to slow patching, for a combined 85% (respondents could select both). The report suggests that figure is likely an undercount, since an incident can only be traced back to an unpatched system the organization knew it had. Exploiting a known, unpatched vulnerability was the number one initial breach vector in Verizon’s 2026 Data Breach Investigations Report, at 31% of breaches.

The Java Estate Nobody Accounts For

Java runs underneath many of an enterprise’s most critical business applications, and as teams, acquisitions and cloud migrations have multiplied the number of runtimes, few organizations have a complete picture of where they all are. It runs reliably, and because it rarely causes problems, it often gets less scrutiny than it deserves.

Asked what portion of their production Java runtime estate is on the latest available security patch level, only 19% of leaders said nearly all of it, 90% or more. That means 81% of organizations have gaps in patch coverage, including 21% who say half or less of their estate is current.

Visibility is the second blind spot. While 49% claim full visibility into every instance of their critical Java runtimes, including embedded, legacy and unmanaged instances, 51% concede they have only partial or limited visibility and suspect there are instances they cannot see. Azul’s analysis suggests that even the 49% figure is likely optimistic, because missing instances are invisible to the tools that should report them.

The October compromise of eight eMudhra intermediate certificate authority keys shows what that blind spot can cost: browser vendors blocked the certificates, but Java runtimes keep their own trust stores and do not check revocation by default, so every runtime, including those embedded in applications and containers, needed its own update.

Intent to Patch Is Not a Deadline

Two-thirds of organizations (66%) have no mandated, time-bound commitment for patching non-critical vulnerabilities. Broken out, 38% patch on a “best effort” basis, 33% mandate a defined service-level agreement (SLA), 25% take a risk-based approach and patch only what is judged high priority, and 3% have no formal policy at all. That matters because AI agents are increasingly able to chain together vulnerabilities across systems: in a July 2026 OpenAI evaluation, autonomous agents running with reduced safeguards chained vulnerabilities to escape their test sandbox and gain unauthorized access to Hugging Face systems.

Asked to name their biggest barriers to patching quickly, security leaders put three internal constraints at the top: extensive pre-deployment testing (44%), the complexity or age of affected systems (40%) and limited visibility into known vulnerabilities (36%). Delays in receiving patches from vendors was among the least cited at 25%, and is the only barrier on the list outside the enterprise’s control.

Where Leaders Are Placing Their Bets

For the next 12 months, 32% of leaders name faster and more frequent patching and 26% name better visibility and inventory of software and runtimes as their primary strategy for reducing exposure, while 17% plan to invest in detection and response rather than faster patching. Together, faster patching and better visibility account for 58% of leaders’ primary strategies, and they correspond to the two problems this report traces end to end: you cannot patch what you have not found, and finding it does not help if remediation takes longer than exploitation. Every day between a fix becoming available and reaching production is a day an organization’s own testing, deadlines and inventory leave open.

“Agentic AI has collapsed the margin defenders depend on, and most enterprises are still running patch processes built for a much slower adversary,” said Scott Sellers, co-founder and CEO of Azul. “Our research shows security leaders understand the threat: awareness is no longer the gap; execution is. No one can eliminate zero-day risk, but every organization decides how long it stays exposed by how much of its Java estate it can see and how fast a fix can move through it. Azul’s Security-only, Stability-first™ updates include only security patches, with nothing else bundled in that could risk breaking things, so enterprises can move fast and close that exploitation window before an attacker finds it first.”

To read the full findings and benchmark your own patch cycle, download the 2026 AI Vulnerability Gap Report. Find more information on Azul’s Security-only, Stability-first™ updates.

About the Report

The research was commissioned by Azul and conducted independently by Censuswide among 300 U.S. security leaders, including CISOs, VPs and directors of information security, heads of security, security architects, SecOps and DevSecOps leaders and AppSec leaders, at organizations with 1,000 or more employees where Java and Java Virtual Machine (JVM)-based runtimes make up a significant share of the production application estate. All respondents have direct responsibility for, or significant influence over, cybersecurity strategy, vulnerability management or patching policy. Fieldwork was conducted August 3–7, 2026. Censuswide abides by the Market Research Society (MRS) Code of Conduct and ESOMAR principles.

FAQs

How should security teams respond to AI models that can exploit Java at machine speed?

Security teams should shorten patch deadlines, keep a current inventory of every Java runtime and Java component, and prioritize fixing known exploited vulnerabilities and internet-facing systems first, because AI is compressing the time between disclosure and exploitation. The speed of vendor patch delivery matters as much as internal process. Azul provides Security-only, Stability-first™ updates for Java 8, 11, 17, 21 and 25 as well as older versions like Java 6 and 7.

How quickly should a Java runtime distribution patch a newly disclosed CVE?

A Java runtime distribution should deliver a fix for a newly disclosed critical vulnerability, tracked as a Common Vulnerabilities and Exposures (CVE) entry, on the day it is disclosed, because attackers now move in days or even hours. According to Azul, community OpenJDK builds usually appear days to weeks later. Azul released its October 2026 Security-only, Stability-first™ updates the same day as the OpenJDK disclosure of 53 vulnerabilities, the most in a single update in well over a decade.

What’s the right cadence for Java security patching in the enterprise?

Most enterprises should patch Java on a regular quarterly baseline aligned to the OpenJDK cycle, add monthly updates for critical vulnerabilities, and be able to deploy out-of-cycle fixes when a flaw is being actively exploited. A fixed calendar alone is no longer enough as AI shortens the time to exploit. Azul ships its Security-only, Stability-first™ updates quarterly, monthly and out of cycle for Java 8, 11, 17, 21 and 25 as well as older versions like Java 6 and 7.

How do we patch Java quickly while minimizing production risk?

Enterprises can significantly reduce production risk and testing effort by deploying updates with only security fixes, because unrelated changes are common sources of regressions and require significantly more testing. Full OpenJDK quarterly updates can include hundreds of non-security code changes. Azul’s Security-only, Stability-first™ updates contain only security fixes and are built on the previous quarter’s full OpenJDK release that the Java community has already deployed broadly and stably.

How do we know which Java runtimes are exposed to a newly disclosed vulnerability?

Enterprises can identify exposed Java runtimes by building an automated inventory of every runtime, including embedded, containerized and unmanaged instances that asset-management tools often miss, with version and patch level mapped against known vulnerabilities. Spreadsheets and manually maintained configuration management databases rarely keep up. Azul’s JVM Vulnerability Risk Assessment maps Java Virtual Machine (JVM) exposure across an enterprise, shows which runtimes are on end-of-life versions or carry known exploited vulnerabilities, and delivers a prioritized remediation roadmap. Azul ‘s Intelligence Cloud JVM Inventory (JVMI) feature extends this with continuous discovery, so when a new vulnerability is disclosed, teams can immediately see which runtimes are affected rather than starting a manual search.

About Azul

Azul is the trusted leader in enterprise Java for today’s AI-first world. Its open source-based Java platform empowers organizations to optimize the entire Java lifecycle to accelerate performance, strengthen security, reduce licensing and cloud costs, and boost developer productivity. Azul powers mission-critical systems for 37% of the Fortune 100, 50% of the Forbes Top 10 World’s Most Valuable Brands, and the world’s top 10 financial trading companies. Learn more at azul.com and follow @azulsystems.

Media gallery

About The Author
Business Wire