Java Runtime Environment (JRE) vulnerabilities: known CVEs & security history
Oracle · Actively exploited · 11 tracked CVEs · 0 actively exploited · updated August 2026 · what is a CVE? →
This is the full list of known vulnerabilities (CVEs) across all Java Runtime Environment (JRE) release lines — 11 in total. A CVE here doesn't mean your version is affected — check Java Runtime Environment (JRE)'s current status and the safe version to run.
Known Java Runtime Environment (JRE) CVEs
Actively-exploited and most-severe first. Open any CVE for full details.
| CVE | Severity | CVSS | EPSS | Year |
|---|---|---|---|---|
| CVE-2016-9841 | critical | 9.8 | 8% | 2017 |
| CVE-2016-9842 | high | 8.8 | 5% | 2017 |
| CVE-2016-9840 | high | 8.8 | 5% | 2017 |
| CVE-2026-34282 | high | 7.5 | 1% | 2026 |
| CVE-2026-22016 | high | 7.5 | 1% | 2026 |
| CVE-2026-21945 | high | 7.5 | 1% | 2026 |
| CVE-2026-21932 | high | 7.4 | 0% | 2026 |
| CVE-2026-46968 | medium | 5.9 | 0% | 2026 |
| CVE-2026-47021 | medium | 5.3 | 0% | 2026 |
| CVE-2026-47013 | medium | 5.3 | 0% | 2026 |
| CVE-2026-47010 | low | 3.7 | 0% | 2026 |
Is my Java Runtime Environment (JRE) version affected?
The list above spans every release. To know whether your version is affected — and the minimum safe version to upgrade to — check it directly.
Check your Java Runtime Environment (JRE) version → · Monitor Java Runtime Environment (JRE) for new CVEs →
Java Runtime Environment (JRE) vulnerabilities — frequently asked
How many known vulnerabilities does Java Runtime Environment (JRE) have?
IsItPatched tracks 11 CVEs for Java Runtime Environment (JRE). 1 is critical-severity and 6 high-severity. These span every release line — what matters is whether the version you run is affected.
Does Java Runtime Environment (JRE) have any actively-exploited vulnerabilities?
None of Java Runtime Environment (JRE)'s tracked CVEs are currently in CISA's KEV catalog — but new ones can be added at any time, so keep your version current.
What is the most severe Java Runtime Environment (JRE) vulnerability?
Among tracked issues, CVE-2016-9841 (CRITICAL, CVSS 9.8) ranks highest.
Is Java Runtime Environment (JRE) safe to use?
It depends on the version. The latest supported Java Runtime Environment (JRE) release clears the known issues; older versions may still be affected. Check the exact version you run for a verdict.
CVE data aggregated from NVD, CISA KEV and EPSS (FIRST.org). Related: Java Runtime Environment (JRE) security status · Java Runtime Environment (JRE) end-of-life · actively-exploited CVEs. Always verify against Oracle's advisories — see our disclaimer.