Oracle Java SE End of Public Updates: What Each Version Means for Your Enterprise

1. What Oracle Java SE End of Public Updates Actually Means

Oracle Java SE End of Public Updates (EOPU) is the date at which Oracle stops releasing publicly available security and bug-fix updates for a specific Java SE version. Before EOPU, Oracle releases Critical Patch Updates (CPUs) quarterly for the version, which are accessible without a commercial license under certain terms. After EOPU, Oracle continues to release updates for that version — but only to paying subscribers under Premier Support or Extended Support agreements. The free security patch pipeline for that version closes permanently.

This distinction matters enormously for enterprises that have been using Oracle JDK without a commercial subscription. Before EOPU, the absence of a commercial license creates an audit and compliance risk — Oracle's licensing terms for commercial use have required a subscription since January 2019. After EOPU, continuing to run an EOPU version of Oracle JDK creates both a compliance risk and a security risk: no free patches, and Oracle's position is that any commercial use after January 2019 required a subscription regardless of the version.

EOPU is also Oracle's primary lever for driving Java SE subscription adoption. Oracle times Extended Support availability and pricing to make the commercial subscription appear cost-effective compared to running without security patches. The reality is that OpenJDK distributions — from Adoptium, Azul, Amazon Corretto, Red Hat, and others — provide free, high-quality security updates for current LTS versions with no Oracle involvement. EOPU is a trigger to migrate to OpenJDK, not a trigger to buy an Oracle Java SE subscription.

2. Oracle Java SE Lifecycle by Version: EOPU and Support Dates

Oracle operates a tiered support model for Java SE: Premier Support (available to subscription customers), Extended Support (at additional cost), and Sustaining Support (indefinite, for critical issues only). The following table summarises the key lifecycle dates for the Java SE versions most commonly found in enterprise environments:

The table above highlights the complexity of the Java SE lifecycle. Java 8 is a special case: Oracle terminated free public updates for non-commercial use in January 2019, but continues to deliver commercial updates under Extended Support through December 2030. Java 11 reached its EOPU date in September 2023 and is now in Extended Support — meaning Oracle subscribers can still receive security updates, but the free update channel closed over two years ago. Java 17 and Java 21, as current LTS versions, remain in Premier Support and are the recommended migration targets for enterprises leaving earlier versions.

3. Java 8: The Longest-Running EOPU Risk in Enterprise Java Estates

Java 8 is still present in a significant percentage of enterprise Java deployments, despite the non-commercial EOPU date passing in January 2019. The persistent presence of Java 8 in enterprise environments is driven by application compatibility dependencies — older Oracle E-Business Suite versions, JD Edwards deployments, Siebel installations, and independently developed applications that were certified against Java 8 and have not been migrated. Understanding Java 8's complicated lifecycle is essential for any enterprise planning its Java estate compliance strategy.

The January 2019 non-commercial EOPU date is the most important date for unlicensed Oracle JDK deployments. Before January 2019, Oracle offered free public updates to Java 8 for both personal and commercial use — meaning an enterprise running Oracle JDK 8 without a commercial license was not in violation of Oracle's terms (though the licensing boundary was always more complex in practice). After January 2019, Oracle's terms required a commercial Java SE subscription for any production use of Oracle JDK. Organizations that continued running Oracle JDK 8 after January 2019 without purchasing a subscription accumulated a commercial licensing obligation — one that Oracle's LMS audit scripts are specifically designed to quantify.

The Java 8 Extended Support Extension

Oracle has extended Java 8 Extended Support multiple times, currently to December 2030. This extension reflects the commercial reality that large enterprise application suites — particularly Oracle's own EBS and JD Edwards products — continue to certify Java 8 deployments. Oracle's Extended Support for Java 8 is available to organizations with a paid Java SE subscription. The commercial update channel for Java 8 remains active, delivering quarterly CPU patches to subscribers. Organizations running Oracle JDK 8 without a subscription cannot access these patches and are running on the last free release from January 2019 — now over seven years old — with all associated security vulnerabilities.

For enterprises with Oracle JDK 8 deployments, our Oracle Java Licensing Advisory consistently recommends one of two paths: migrate to Adoptium Temurin 8 (a free, actively supported OpenJDK distribution that tracks the same security patches as Oracle's commercial Java 8) or migrate to Java 17 or 21. Oracle JDK 8 with a commercial subscription is rarely the right answer given the cost structure of Oracle's Employee Metric licensing.

4. LTS Versions: Java 11, 17 & 21 — Support Lifecycle and Migration Pressure

Oracle's Long Term Support (LTS) release cadence was designed to give enterprises predictable support windows and reduce migration frequency. LTS versions receive Premier Support for typically five years from release, followed by Extended Support for an additional three years. Non-LTS versions (sometimes called "feature releases") receive only six months of Premier Support before transitioning to Sustaining Support — making them unsuitable for enterprise production deployments where security patching continuity is required.

Java 11: EOPU Has Passed — Extended Support Only

Java SE 11 reached its EOPU date in September 2023. Oracle continues to release quarterly CPU security updates for Java 11 — but only to paying Java SE subscribers under the Extended Support program. The free public update channel for Java 11 closed in September 2023. Organizations running Oracle JDK 11 without a subscription have received no security patches for over two years. This is an active security vulnerability risk in addition to the commercial licensing compliance obligation. The recommended path for Java 11 deployments is migration to Adoptium Temurin 11 (free, actively patched OpenJDK) or Java 17/21.

Java 17: Premier Support Through September 2026

Java SE 17 is in Premier Support through September 2026, after which it transitions to Extended Support. For organizations that migrated from Java 8 or 11 to Java 17 under the assumption that free Oracle JDK use was available, the September 2026 EOPU date is a critical planning horizon — Oracle JDK 17 will require a commercial subscription for continued security patching after that date. The practical recommendation is to migrate from Oracle JDK 17 to Adoptium Temurin 17 or Amazon Corretto 17 now, before the EOPU date creates urgency that Oracle can exploit commercially.

Java 21: The Current LTS Target Through 2028

Java SE 21, released in September 2023, is the current LTS version with Premier Support through September 2028. Java 21 is the recommended migration target for most enterprise workloads. Critically, Java 21 is available as Oracle JDK (commercial, subscription required for production use) and as Adoptium Temurin 21, Amazon Corretto 21, Microsoft Build of OpenJDK, and other OpenJDK distributions at zero cost. The capabilities of these OpenJDK distributions are equivalent to Oracle JDK 21 for the vast majority of enterprise use cases. Our Oracle Java Licensing Guide covers the technical differences between Oracle JDK and OpenJDK distributions in detail.

5. Oracle Extended Support: The True Cost of Staying on Older Java Versions

Oracle's Extended Support program allows Java SE subscribers to continue receiving security updates for older LTS versions after the Premier Support EOPU date. Extended Support is available as part of the Java SE Universal subscription — the same per-employee subscription that covers all current Java SE versions. However, Oracle has in the past applied an Extended Support surcharge (typically 10-20% on top of the standard support fee) for versions in Extended Support. The commercial terms of Extended Support are subject to negotiation and the specifics of your Oracle agreement.

The most important point about Extended Support is the choice it represents: pay Oracle for continued security patching on an older Java version, or migrate to an OpenJDK distribution that provides free security patching for the same version. For Java 11, Adoptium Temurin 11 continues to receive community security updates. For Java 8, Adoptium Temurin 8 tracks the Oracle Java 8 Extended Support patch stream closely. The argument for paying Oracle for Extended Support rather than migrating to OpenJDK is very limited — it applies almost exclusively to organizations with applications that require Oracle-specific Java SE features or Oracle-certified JVM behavior that OpenJDK distributions do not replicate.

The Extended Support Pricing Trap

Oracle's Extended Support pricing is structured to appear modest relative to the risk of running without security patches. A 10,000-employee organization paying Oracle's Java SE Universal subscription of approximately $15 per employee per year would pay $150,000 per year for Extended Support coverage of their Java 11 estate. That $150,000 buys security patches for an Oracle JDK installation that an OpenJDK distribution would patch for free. Our Oracle Support Cost Reduction engagements have repeatedly demonstrated that the true cost of Oracle's Java SE subscription is unjustifiable when OpenJDK alternatives are available. The migration cost to Adoptium Temurin — typically a single JVM binary replacement — is measured in weeks, not months, for well-managed Java estates.

6. Commercial Implications When Your Java Version Reaches EOPU

The moment a Java version reaches EOPU, Oracle's commercial team becomes more active with organizations known to be running that version. Oracle tracks Java SE deployments through support registrations, audit data from past LMS engagements, and intelligence gathered from field sales interactions. When a version approaches EOPU, Oracle sales and licensing teams contact target accounts with offers to purchase Java SE subscriptions that would provide Extended Support. These offers are framed as security risk mitigation — but they are also the mechanism through which Oracle converts unlicensed deployments into revenue-generating subscriptions.

The pattern we see repeatedly in our Oracle Audit Defense work: an organization receives an Oracle outreach call or email about Java SE subscription "options" as their version approaches EOPU. The Oracle sales team confirms the version deployed, collects information about the environment "to provide a quote", and this information subsequently appears in an LMS audit scope. The commercial conversation about EOPU and Extended Support is Oracle's intelligence-gathering mechanism as much as it is a genuine support offer. Enterprises should treat all Oracle Java SE license enquiries as potential pre-audit activity and engage through qualified advisors rather than directly with Oracle's sales or licensing teams.

7. Planning Your Java Migration Before EOPU — The Buyer-Side Strategy

The optimal Java estate strategy treats EOPU dates as planning horizons, not crisis triggers. An enterprise that begins OpenJDK migration 12-18 months before a version's EOPU date operates from a position of strength: time to test application compatibility, no Oracle sales pressure, and no audit urgency. An enterprise that begins migration the month before EOPU is exactly where Oracle wants them: rushed, potentially accepting an Oracle subscription "bridge" to buy time, and disclosing deployment details to Oracle in the process.

Step 1: Inventory Your Java Estate Before Oracle Does

The first step in any pre-EOPU migration plan is a comprehensive Java inventory — identifying every Oracle JDK installation across every server, virtual machine, container image, and developer workstation in the environment. Enterprises consistently underestimate the scope of their Java deployments: Oracle JDK is frequently silently bundled by application vendors, installed by automated processes, and distributed through desktop management without IT's knowledge. Tools such as Flexera, Snow, Certero, and purpose-built Java discovery scripts can build the inventory. Our Java installation inventory guide covers the technical approach in detail.

Step 2: Assess Application Compatibility with OpenJDK

The primary risk in migrating from Oracle JDK to OpenJDK is application compatibility. In practice, for Java 8 and above, the compatibility between Oracle JDK and leading OpenJDK distributions (Adoptium Temurin, Amazon Corretto) is extremely high. Oracle JDK since Java 11 is essentially a build of OpenJDK with a few Oracle-specific extensions — extensions that are rarely used in enterprise applications. Application testing in a staging environment before migration is best practice, but most organizations discover that OpenJDK is a transparent drop-in replacement for the vast majority of their Java 8, 11, and 17 applications.

Step 3: Execute the Migration and Document It

OpenJDK migration documentation is your evidence base if Oracle subsequently argues that you owe back-license fees. Document the date of each Oracle JDK deinstallation, the version removed, the system it was removed from, and the OpenJDK distribution installed in its place. Retain screenshots, automated deployment logs, and any scan results from post-migration discovery exercises. This documentation does not eliminate the pre-migration Oracle JDK obligation — but it establishes a clear remediation date that limits Oracle's claim period and demonstrates good-faith compliance activity, which is essential in any subsequent audit negotiation. Our Oracle Compliance Review service includes assisted migration documentation for exactly this purpose.

Step 4: Consider Your Remaining Oracle Contract Obligations

Organizations that have an existing Oracle Java SE subscription — or an Oracle ULA that includes Java SE — should review the subscription terms before migrating to OpenJDK. Migrating away from Oracle JDK during an active subscription period does not automatically reduce the subscription cost; Oracle's Java SE Universal subscription is priced on an employee headcount basis and is payable regardless of deployment. The right time to execute the OpenJDK migration is at subscription renewal — and our Oracle Contract Negotiation team can structure the renewal exit to ensure the migration timeline aligns with the contractual savings opportunity.