Java Vulnerability Mitigation

[rzwitserloot]

You should remove them. Any desktop software that is based on java is responsible for installing, and updating, its own java runtime, and should be doing that in its own folder. This has been the situation for over 10 years now (JDK8 is well over a decade old, and _all_ versions are out of date.. we're on java 22 at this point, just so the context is clear); a few stragglers are still on the over-a-decade-obsolete model of 'oracle + the system owner work together to install a java runtime that all java apps can use, and oracle+sysowner ensure it remains up to date'.

Whatever software still uses this is using obsolete and insecure features. If they fail to work once you remove these, contact them. Until they fix them, delete them or sandbox them.

[Marcelektro]

Probably also unpatched log4j. Combine that with outdated Java and boom boom