Remediating OpenJDK Vulnerabilities in WCC 24.1

Products

• Autosys Workload Automation

Issue/Introduction

Security scans or penetration tests against Workload Control Center (WCC) 24.1 identify multiple high-risk vulnerabilities associated with the installed version of OpenJDK (e.g., version 21.0.8). These vulnerabilities typically include, but are not limited to:

• CVE-2026-22016
• CVE-2026-34282
• CVE-2026-22021
• CVE-2026-22013
• CVE-2026-23865
• CVE-2026-22008
• CVE-2026-22018
• CVE-2026-22007
• CVE-2026-34268

Environment

Product: Workload Control Center (WCC)
Version: 24.1
Java Version: OpenJDK 21.0.x

Cause

WCC 24.1 is distributed with OpenJDK 21.0.5. Over time, security researchers identify vulnerabilities in specific Java builds. If the environment has not been updated to the latest maintenance release of the JDK, these vulnerabilities will trigger security flags during audits.

Resolution

To remediate these vulnerabilities, you must upgrade the JRE/JDK used by WCC to the latest compatible maintenance release within the 21.0.x family.

• Step 1: Download the Updated JDK
  Obtain the latest maintenance release of OpenJDK 21 (64-bit) from your preferred provider. For example, Adoptium Temurin 21.0.11 or later.
  
  
• Step 2: Replace the JDK
  
  1. Stop all WCC services.
  2. Create a backup of the existing jre directory within the WCC installation path.
  3. Replace the contents of the jre directory with the files from the new JDK/JRE 21 maintenance release.
     • Windows: %CA_WCC_INSTALL_LOCATION%\jre
     • UNIX/Linux: $CA_WCC_INSTALL_LOCATION/jre


• Step 3: Configure Security Providers
  Ensure that any required security providers are correctly sequenced in the java.security file of the new installation.
  When upgrading the JRE, you must manually add the following entry to the java.security files of the new JRE:
  security.provider.10=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
  
  Refer to existing WCC configurations for specific BouncyCastleFipsProvider requirements if applicable.
  
  
• Step 4: Verify and RestartRestart WCC services.
  
  1. Verify the version by running java -version from the WCC runtime binary path to confirm it reflects the new version (e.g., 21.0.11).
  2. Re-run the security scan to confirm remediation of the identified CVEs.

Additional Information

For additional information on updating the JRE, see JRE Update in the AutoSys documentation.