Oracle JDK 20 EOL September 19, 2023: Action Plan

What Happens on September 19, 2023

Oracle JDK 20 reaches end of life on September 19, 2023. After that date, Oracle will issue no further security patches, bug fixes, or updates for this release. Any critical vulnerabilities discovered—including zero-days—will remain unpatched in perpetuity under Oracle's support model. Your vendor SLAs, technical support cases, and access to Oracle's knowledge base for JDK 20 all terminate on the same day.

Because JDK 20 is not a long-term support (LTS) release, this short lifecycle was expected. The final version in the 20.x line is 20.0.2. Organizations that deployed JDK 20 in production now face a narrow window to prepare for life after vendor support ends.

Why Migration Before EOL Is No Longer Realistic

With approximately three months remaining, a full migration to JDK 21 or an LTS release such as JDK 17 is impractical for most enterprises. Application compatibility testing, dependency audits, CI/CD pipeline updates, and staged rollouts across development, test, and production environments typically require four to six months of disciplined effort. Rushing that process invites production outages, regression bugs, and untested code paths going live under pressure.

The smarter approach is to acknowledge the timeline, secure your current environment, and plan a methodical transition over the next six to twelve months while maintaining support coverage throughout.

Your 90-Day Action Plan

Weeks 1–2: Complete Asset Inventory

• Scan all environments—development, test, staging, and production—to identify every server, container, and workstation running JDK 20.
• Document the applications and services that depend on JDK 20, noting any custom-built or vendor-supplied software with hard dependencies.
• Tag systems by criticality: customer-facing production, internal business-critical, and low-risk development or testing.

Weeks 3–4: Assess and Document Risk Exposure

• Map each JDK 20 instance to the data it processes, especially regulated data (PCI, HIPAA, GDPR) or intellectual property.
• Identify network exposure: internet-facing applications, API endpoints, and services accessible from untrusted networks.
• Prepare a risk register for your CISO, auditors, and cyber insurers that quantifies the post-EOL exposure and your mitigation strategy.

Weeks 5–6: Implement Hardening Measures

• Restrict network access to JDK 20 workloads using firewall rules, VLANs, or zero-trust segmentation.
• Disable unused Java features, libraries, and remote management interfaces to shrink the attack surface.
• Enable comprehensive logging and integrate JDK 20 systems into your SIEM for anomaly detection.
• Review and tighten authentication, authorization, and input validation in any applications running on JDK 20.

Weeks 7–9: Arrange Third-Party Support

• Evaluate third-party support providers that offer security patches, bug fixes, and extended maintenance for Oracle JDK 20 past the vendor EOL date.
• Request a statement of work that specifies patch SLAs, CVE response times, and compatibility testing for your specific application stack.
• Finalize contracts so coverage begins on September 20, 2023, with no gap in support.

Weeks 10–12: Plan the Long-Term Migration

• Draft a phased migration roadmap targeting JDK 21 or the next LTS release.
• Allocate budget and engineering resources for compatibility testing, code refactoring, and vendor application upgrades.
• Set a realistic go-live target—Q2 or Q3 2024 for most organizations—and communicate the timeline to stakeholders.
• Ensure your third-party support agreement covers the full migration period so you can move deliberately without operational risk.

What Third-Party Support Provides

Once Oracle's support ends, third-party support providers step in to deliver the security patches, bug fixes, and technical assistance your estate requires. These vendors maintain their own build and test infrastructure, issue patches for newly disclosed CVEs, and provide SLA-backed support for production incidents. For applications that cannot migrate quickly—legacy codebases, vendor software without JDK 21 certification, or tightly coupled integrations—third-party support is often the only path to maintaining both security and compliance.

Unlike a hasty migration driven by an arbitrary EOL deadline, third-party support gives your team the time to test thoroughly, refactor carefully, and deploy with confidence. It also satisfies auditors and insurers who require evidence of active patch management for any software processing regulated or sensitive data.

Final Recommendations

With 90 days until Oracle JDK 20 reaches end of life, your immediate priority is visibility and containment. Know where JDK 20 is running, understand the risk each instance presents, and reduce exposure through network and application-layer hardening. Document your findings and your plan so that compliance, risk, and executive stakeholders see a deliberate strategy rather than an unmanaged gap.

Then arrange support coverage that extends past September 19, 2023. Whether you complete your migration in six months or eighteen, continuous patch availability and vendor-neutral technical support ensure you stay secure and compliant throughout the transition.

For organizations evaluating third-party support options, contact our team to discuss Oracle JDK coverage, patch SLAs, and migration planning assistance tailored to your environment and timeline.