Waratek today published its first State of Java Exploits report, which finds a wide gap between the number of security flaws reported in Java software and the number attackers actually use.
Between 1 January and 1 November 2026, 5,649 Java CVEs were published, more than seven times as many as in the same months of 2025. Yet, by 1 November attackers had exploited only 18 of this year’s flaws compared to 19 known vulnerabilities at the same point last year.
Most of the surge comes from Oracle, whose products account for 3,659 of this year’s Java CVEs, up from 165 in 2025. Oracle’s software is mostly closed source, and only two of those flaws have public exploit code. Across all 5,649 new Java CVEs, just 36 have a known public exploit.
“When thousands of vulnerabilities are published annually, relying on CVE counts alone is a recipe for alert fatigue,” said Apostolos Giannakidis, Waratek’s CTO. “Meaningful application security requires runtime visibility into which vulnerabilities are present and reachable, combined with evidence-driven risk prioritisation that considers real-world exploitability and potential business impact.”
Key findings
The report covers 17,689 published Java CVEs from multiple vulnerability listing sources. Of those, 288 have been attacked in the wild, about one in 61. Its main findings:
- Severity scores are a poor guide to attack. Patching every Java CVE scored CVSS 7.0 or higher means patching 8,640 flaws, half the total. That still misses 50 of the 288 attacked, about one in six.
- Public exploit code is a far better signal. Exploit code is public for 691 Java CVEs, fewer than one in 25. Those 691 include 230 of the 288 attacked flaws, four in five, on a list twelve times shorter than the CVSS 7.0+ queue. Counting only code published before any recorded attack, the list still holds seven in ten attacked flaws.
- In Java, exploit code leads to attacks more often. One Java CVE in three with public exploit code has been attacked, against one in ten for all other software.
- Forecasts miss most new attacks. Of the 46 Java CVEs first attacked in the past year, a list of the top 1% of EPSS forecasts drawn up a year earlier included 7. Eighteen had not yet been published.
- Three kinds of bugs do most of the damage. Injection, deserialization and file-handling flaws are 14% of Java CVEs but 51% of attacked ones. Access-control flaws are the reverse: almost half of Java CVEs, about a quarter of attacks.
- Attackers return to the same projects. Twelve projects, including Apache Struts, Oracle WebLogic Server, Jenkins, Spring and Log4j, account for 52% of attacked Java CVEs but 26% of all Java CVEs. Every year from 2016 to 2025 produced at least one WebLogic flaw that was later attacked.
- The JDK got safer; the software built on it did not. No JDK flaw published since 2016 has been attacked. CVEs in Java frameworks and products outside Oracle rose from about 60 in 2010 to 1,990 so far in 2026.
- Old Java bugs stay dangerous. Java CVEs attacked this year have a median age of 4.5 years, against 2.0 years for other software. In October 2026, CISA added a ten-year-old Struts flaw to its Known Exploited Vulnerabilities catalogue.
- Attacks on Java are easy to automate. Two-thirds of attacked Java CVEs are rated “automatable” by CISA, against fewer than half of other attacked CVEs. 17% have known ransomware use.
Where defense should start
The report concludes that the flaws attackers use have a recognizable profile: public exploit code, a few kinds of flaws, a dozen projects, and often years of age. That short list, not the annual CVE total, is where defenders should start.
“No team can patch 5,649 CVEs in a year, and the severity score won’t tell them which ones matter,” said Jakub Mikulas, Waratek VP of Engineering. “Public exploit code is a far better guide: four in five attacked Java flaws have it. Start there. But some flaws are attacked almost as soon as they are published. This past year, nine Java flaws had recorded attacks within a week of being published, five of them on the same day. Waratek covers both cases. Its virtual patches protect known flaws while teams work through their upgrades, and its rules stop attacks such as injection and deserialization even when the flaw has not been reported yet.”
About the Waratek State of Java Exploits Report
The Waratek State of Java Exploits 2026 draws on a single dated snapshot of public sources, taken on 2 November 2026 and counted to 1 November. Sources include the National Vulnerability Database, OSV, CISA’s Known Exploited Vulnerabilities catalogue and SSVC data, VulnCheck KEV, Exploit-DB, Metasploit, Nuclei and GitHub. A flaw counts as attacked if it appears in either KEV catalogue or is marked “active” by CISA.
Read the full State of Java Exploits 2026 report.
For more information or to schedule an interview, contact: Doug Ennis, CEO (Douge@waratek.com)
About Waratek
Waratek offers Waratek IAST+RASP, the only compiler-based, runtime application tools that find vulnerabilities in the pre-production development pipeline, block attacks in production, and virtually patch flaws with no downtime or source code changes. Waratek IAST watches code execute to identify security flaws with absolute certainty, eliminating the “guesswork” and alert fatigue associated with traditional scanners. Waratek RASP intercepts and terminates unsafe operations at the JVM level, stopping attempts to change app behavior in attacks aimed at known and Zero Day vulnerabilities. Waratek is a trusted partner for organizations in global financial services, hospitality, healthcare, technology and other industries. Waratek has offices in Dublin, Ireland and Chicago, Illinois.
