Unimus forum

Back again with another detected vulnerability in our Unimus software. We're running 2.7.1 on an Azure virtual server, and our vulnerability scanner is reporting a vulnerability involving the embedded Java instance in the software.

The specific finding is: Unspecified vulnerability in Oracle Java SE, Azul Zulu and Amazon Corretto via vectors related to AWT, JavaFX - CVE-2026-21932

The files it's triggering on are:
C:\Program Files\Unimus\jre17\bin\java.exe
C:\Program Files\Unimus\jre17\bin\javaw.exe

Both versions are 17.0.16.0, and this version apparently is subject to the CVE listed above. I understand from the last post that I made that Unimus doesn't allow external Java code to be executed. Will there be an updated version coming out to address this?

Hello.

I looked into CVE-2026-21932. Unimus is NOT affected at all by this vulnerability. The vuln is specifically in Java Web Start / Applet handling. Unimus doesn't run as a JWS / Applet at all.

Since Unimus runs as a fully featured server, and this CVE is related to running Applets in the Browser, this vuln is not relevant to Unimus at all and you can 100% consider this as not applicable to Unimus.

We will update the embedded JVM to the latest version as always with the next release, but you can ignore this one

Thanks for the confirmation, we'll mark this one as accepted and update when the next version is released!