Ignition ships its own Java runtime (Azul Zulu) and never uses a Java installed on the host. If nothing else on the server needs Java, remove the OS install.
Our commitment: every Ignition minor release is eligible for the latest available Java (Azul) security updates as they align with the Ignition release’s QA window.
Azul publishes two quarterly update lines. PSU (Patch Set Update) carries that quarter’s security fixes plus bug fixes and new features. CPU (Critical Patch Update) carries only that quarter’s security fixes, applied on top of the previous quarter’s PSU. Ignition follows the CPU line which offers the same CVE coverage, lower regression risk, and a smaller QA surface so updates ship faster.
Info: When reading a scan against the bundled runtime: JavaFX WebKit (javafx.web) CVEs never apply, since Ignition ships only the base, controls, and graphics JavaFX modules. Many other Java CVEs apply only to deployments running untrusted code under the Java sandbox, which Ignition does not do.
For the October 2026 update (Java 17.0.20.1.101), the current targets are 8.1.56/57 (tbd) and 8.3.11 (11/17/26).