Back again with another detected vulnerability in our Unimus software. We're running 2.7.1 on an Azure virtual server, and our vulnerability scanner is reporting a vulnerability involving the embedded Java instance in the software.
The specific finding is: Unspecified vulnerability in Oracle Java SE, Azul Zulu and Amazon Corretto via vectors related to AWT, JavaFX - CVE-2026-21932
The files it's triggering on are:
C:\Program Files\Unimus\jre17\bin\java.exe
C:\Program Files\Unimus\jre17\bin\javaw.exe
Both versions are 17.0.16.0, and this version apparently is subject to the CVE listed above. I understand from the last post that I made that Unimus doesn't allow external Java code to be executed. Will there be an updated version coming out to address this?
[Solved] Another Java vulnerability in 2.7.1
Hello.
I looked into CVE-2026-21932. Unimus is NOT affected at all by this vulnerability. The vuln is specifically in Java Web Start / Applet handling. Unimus doesn't run as a JWS / Applet at all.
Since Unimus runs as a fully featured server, and this CVE is related to running Applets in the Browser, this vuln is not relevant to Unimus at all and you can 100% consider this as not applicable to Unimus.
We will update the embedded JVM to the latest version as always with the next release, but you can ignore this one
I looked into CVE-2026-21932. Unimus is NOT affected at all by this vulnerability. The vuln is specifically in Java Web Start / Applet handling. Unimus doesn't run as a JWS / Applet at all.
Since Unimus runs as a fully featured server, and this CVE is related to running Applets in the Browser, this vuln is not relevant to Unimus at all and you can 100% consider this as not applicable to Unimus.
We will update the embedded JVM to the latest version as always with the next release, but you can ignore this one