Is Java (Oracle JDK and OpenJDK builds) supported for Cyber Essentials?
Vendor end-of-support dates by version, and what the security update management control requires if you are past one.
- Status
- 9 of 10 versions supported as of 3 November 2026
- Next end of support
- 31 October 2027 (Eclipse Temurin 17 and 11 (OpenJDK))
- Vendor
- Oracle and OpenJDK vendors
- Category
- Runtime
- Source
- Vendor lifecycle page
- CE Plus test
- Test case 2: authenticated vulnerability scan
Partly. As of 3 November 2026, 9 of 10 listed Java (Oracle JDK and OpenJDK builds) versions are supported for Cyber Essentials. Any JDK without a vendor update entitlement no longer receives security updates and fails A6.2. The next listed end of security updates is 31 October 2027 (Eclipse Temurin 17 and 11 (OpenJDK)).
Is Java (Oracle JDK and OpenJDK builds) supported for Cyber Essentials?
Partly. 9 of 10 listed Java (Oracle JDK and OpenJDK builds) versions were supported on 3 November 2026; the table shows which.
Java is supported for Cyber Essentials when the build you run still receives security fixes and you are entitled to them. Oracle JDK 25 is the current LTS, and Oracle plans to keep its updates free under the NFTC licence until September 2028, a year after the next LTS (JDK 29, planned for September 2027). For business use, Oracle JDK 21 updates from the October 2026 patch, and all JDK 8, 11 and 17 updates, need a paid Oracle subscription. Free OpenJDK builds such as Eclipse Temurin publish their own dates.
Which Java (Oracle JDK and OpenJDK builds) versions are supported?
Oracle JDK 25 (LTS), Oracle JDK 21 (LTS), Oracle JDK 17 (LTS), Oracle JDK 11 (LTS), Oracle JDK 8, Eclipse Temurin 25 (OpenJDK), Eclipse Temurin 21 (OpenJDK), Eclipse Temurin 17 and 11 (OpenJDK), Eclipse Temurin 8 (OpenJDK) are supported as of 3 November 2026. Any JDK without a vendor update entitlement is past end of support.
| Version | Updates end | Cyber Essentials | Note |
|---|---|---|---|
| Oracle JDK 25 (LTS) | 30 September 2033 | Pass | Premier Support to September 2030, Extended Support to September 2033 (Oracle roadmap). Oracle plans to keep updates free under the NFTC licence until September 2028. |
| Oracle JDK 21 (LTS) | 30 September 2031 | Pass | Premier Support to September 2028, Extended Support to September 2031. Releases from 20 October 2026 are under the OTN licence, so business use needs a Java SE Subscription. Supported only with that entitlement; otherwise move to JDK 25 or a free OpenJDK build. |
| Oracle JDK 17 (LTS) | 30 September 2029 | Pass | Premier Support ended September 2026; Extended Support runs to September 2029. Updates on paid subscription only; supported only with that entitlement. |
| Oracle JDK 11 (LTS) | 31 January 2032 | Pass | Extended Support to January 2032, on paid subscription only; supported only with that entitlement. |
| Oracle JDK 8 | 31 December 2030 | Pass | Extended Support to December 2030, on paid subscription for business use; supported only with that entitlement. |
| Eclipse Temurin 25 (OpenJDK) | 30 September 2031 | Pass | Free. Adoptium commits to at least September 2031. |
| Eclipse Temurin 21 (OpenJDK) | 31 December 2029 | Pass | Free. Adoptium commits to at least December 2029. |
| Eclipse Temurin 17 and 11 (OpenJDK) | 31 October 2027 | Pass | Free. Adoptium commits to at least October 2027; plan the move to 21 or 25. |
| Eclipse Temurin 8 (OpenJDK) | 31 December 2030 | Pass | Free. Adoptium commits to at least December 2030. |
| Any JDK without a vendor update entitlement | No fixed date (rolling) | Fail | Unsupported for A6.2. Remove it or move to a supported build. |
Source: https://www.oracle.com/java/technologies/java-se-support-roadmap.html. Last checked 3 November 2026.
How do you check which Java (Oracle JDK and OpenJDK builds) version you are running?
You need the exact version for the device and software lists in the question set, and to compare against the table above. Check each in-scope device, or export the version column from your device management tool.
- Run java -version in a terminal or command prompt. The output names the vendor build (Oracle, Temurin, Microsoft, Amazon Corretto and so on) and the version.
- On Windows, also check Settings > Apps > Installed apps for Java entries; old Java runtimes are often left behind by uninstalled applications.
Record the version with the date you checked it. That dated record is the evidence behind your A6.2 answer and the version lists in A6.2.1 to A6.2.4.
What does "supported" mean under A6.2?
Supported means a vendor still issues regular security updates for the version and has published the date it will stop. Past that date, the version is unsupported.
The requirements define licensed and supported software as software you have a legal right to use and that a vendor has committed to support by providing regular vulnerability fixes, where the vendor provides the future date they will stop. Extended support counts while you can evidence the entitlement. Once the date passes, the software is unsupported whatever it still does.
Question A6.2 asks whether all software on in-scope devices are supported by a vendor that produces regular security updates. It applies to every device in scope, including staff-owned devices under BYOD, and to firewall and router firmware, which the A6.1 guidance treats as an operating system. The same guidance lists Windows 10, macOS Ventura, iOS 15 and Android 12 among its examples of operating systems out of regular support. Paid extensions such as Extended Security Updates count while you can show the licence.
What happens if Java (Oracle JDK and OpenJDK builds) is unsupported?
An unsupported Java (Oracle JDK and OpenJDK builds) version on any in-scope device stops the assessment passing: A6.2 cannot be answered Yes, and A6.3 would be a Yes, which means the licensed-and-supported requirement is not met. It is not labelled an automatic fail, but the assessor will not pass the application until it is fixed. There are three ways to fix it; pick one per device before you submit.
- Upgrade to a supported version. This is the answer for almost every laptop, desktop and server. For applications with a paid extension, enrol and keep the proof.
- Remove the software from in-scope devices, and answer yes to A6.6.
- Move the device into a defined sub-set that prevents all traffic to or from the internet, describe how in A2.2.2, and declare it under A6.7. A sub-set is segregated by a firewall or VLAN. It is a last resort for equipment that cannot be upgraded.
How does Cyber Essentials Plus check this?
Test case 2 checks it: an authenticated vulnerability scan of sampled end-user devices, servers and IaaS instances. The sub-test fails if the scan finds a vulnerability rated critical or high risk by the vendor, scored 7 or above on CVSS v3, or with no severity given, where the vendor fix has been available for more than 14 days.
The test specification adds that virtual patching is not accepted as a long-term mitigation for legacy unsupported operating systems. The Plus audit tests the same scope as the self-assessment certificate, so fix unsupported software before the self-assessment, not after.
Frequently asked questions
Partly. 9 of 10 listed Java (Oracle JDK and OpenJDK builds) versions were supported on 3 November 2026; the table shows which. Java is supported for Cyber Essentials when the build you run still receives security fixes and you are entitled to them. Oracle JDK 25 is the current LTS, and Oracle plans to keep its updates free under the NFTC licence until September 2028, a year after the next LTS (JDK 29, planned for September 2027). For business use, Oracle JDK 21 updates from the October 2026 patch, and all JDK 8, 11 and 17 updates, need a paid Oracle subscription. Free OpenJDK builds such as Eclipse Temurin publish their own dates.
Licensed and supported software is software you have a legal right to use and that a vendor has committed to support with regular vulnerability fixes, with a published future date when they will stop. Extended support still counts. A version past its end-of-support date, or on a paid extension you cannot evidence, is unsupported.
The assessment will not pass until you fix it: A6.2 cannot be answered Yes, and A6.3 (unsupported software in scope) would have to be answered Yes. A6.3 is not labelled an automatic fail, but a Yes means the requirement that all in-scope software is licensed and supported is not met. The three fixes are: upgrade to a supported version, remove the software from in-scope devices, or move those devices into a sub-set with no internet access and declare it under A6.7.
Yes, indirectly. Test case 2 is an authenticated vulnerability scan of sampled devices. Any critical or high-risk vulnerability, or one with a CVSS v3 score of 7 or above, where the vendor fix has been available for more than 14 days fails the sub-test. The specification also states that virtual patching of legacy unsupported operating systems is not accepted.
The dataset was last checked on 3 November 2026 against the vendor lifecycle page linked on this page. Vendors change dates, so confirm against the source before relying on a date near your assessment.
Related pages
- A6.2: supported softwareThe question, the guidance and how assessors mark it.
- A6.7: moving unsupported software out of scopeHow a sub-set must be built.
- Security update managementThe control hub, including the 14-day rule.
- Is it supported? toolLook up any product in the dataset.
- A6.3: unlicensed or unsupported softwareWhat the question asks and why a Yes means the requirement is not met.
- Check your readinessFree checker that asks the auto-fail questions first.
- Glossary: licensed and supported softwareThe NCSC definition, including the published end date.
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)
- oracle.comOracle and OpenJDK vendors lifecycle page for Java (Oracle JDK and OpenJDK builds) · checked 3 November 2026Read on oracle.com (opens in a new tab)
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh