MEDIUM

|Auth: n/a|Reboot: not required|Est. 30–90 minutes depending on number of runtimes|Manual only

Java, Python, Node.js, and .NET Runtimes Must Be Actively Managed and Updated

Unmanaged language runtimes accumulate security vulnerabilities silently — Java, Python, and Node.js on servers are rarely updated unless someone owns the process.

Published May 7, 2026

Why patchRisk explained in plain English

Worst-case scenarioIf unpatched

Vulnerabilities in outdated runtimes can be exploited through applications that use them, by malicious scripts that target the runtime directly, or by deserialization attacks against Java applications. Log4Shell affected any application using a vulnerable Log4j version regardless of the OS patch level.

How the attack works

Language runtimes like Java (JRE/JDK), Python, Node.js, and .NET Framework are installed on Windows Servers to support applications, automation scripts, and tooling. These runtimes receive security updates independently of Windows Update and are not automatically updated. Servers commonly accumulate outdated runtime versions — particularly Java, where multiple versions are often installed simultaneously and old versions remain even when applications are updated.

Am I affected?Quick check

Probably yes if any of these apply:

●Application servers

●Build servers

●Any server with developer tooling installed

●Running Any runtime not on its current supported release

Affected OS versions

Windows Server 2016Windows Server 2019Windows Server 2022

Fixed inLatest stable release for each runtime

Real-world incidentsWhat we've seen

A routine vulnerability scan discovers Java 8u181 (released 2018) still installed on a production application server alongside Java 11. The old version is used by a forgotten service and was never updated. It contains over 40 known CVEs including remote code execution vulnerabilities.

How to patch

Manual remediation steps

⏱ 30–90 minutes depending on number of runtimes

Step 1 — Inventory Installed Runtimes

# Java versions
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
                 HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
    Where-Object { $_.DisplayName -like '*Java*' -or $_.DisplayName -like '*JDK*' -or $_.DisplayName -like '*JRE*' } |
    Select-Object DisplayName, DisplayVersion | Sort-Object DisplayName

# Python versions
Get-ItemProperty HKLM:\Software\Python\PythonCore\* -ErrorAction SilentlyContinue |
    Select-Object PSChildName

# Node.js
node --version 2>$null

# .NET versions
Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP' -Recurse |
    Get-ItemProperty -Name Version, Release -ErrorAction SilentlyContinue |
    Where-Object { $_.Version -match '^[0-9]' } |
    Select-Object PSChildName, Version | Sort-Object Version

Step 2 — Remove Unused Runtimes

# Remove old Java versions via Programs and Features
# Keep only the version required by your application
Get-ItemProperty HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
    Where-Object { $_.DisplayName -like 'Java *' -and $_.DisplayName -notlike '*Development*' } |
    Select-Object DisplayName, UninstallString

Step 3 — Update to Current Supported Versions

Java: Adopt OpenJDK from adoptium.net — update to latest LTS (Java 21)

Python: Download from python.org — update to latest 3.12.x

Node.js: Download LTS from nodejs.org

.NET: Update via Windows Update (Framework) or dotnet.microsoft.com (.NET 8+)

Verification

java -version 2>&1
python --version 2>$null
node --version 2>$null

PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.