We got this from an Oracle representative.

Quickly wanted to introduce myself, reaching out from the Oracle Java team as [your organization's] Account Manager.

I’m currently trying to identify the appropriate contacts to engage within your organization regarding Java security patching and updates. There have been some significant changes that can affect your organization, especially if you are running older versions of Java. Couple of points I wanted to make you aware of:

· A Java SE Subscription is now required to receive version updates and security patches for 3rd party Java applications and in-house developed production environments

· The last public version of Java was released in Jan 2019

· The 21st private patch for Java was released on April 16th

If your organization has a Java footprint, it’s important we connect to discuss how these changes listed above might impact your patch management and security strategies. Does your team have 30 minutes available next week for a quick conversation around these changes?

We're on CF 2021 with jdk-11.0.23, which I believe is the currently recommended Java version for CF 2021. I also thought Adobe had an arrangement with Oracle that covered Java for CF. Can anyone confirm that, ideally someone official from Adobe? Has anyone else been contacted about this?

I run multiple systems off Oracle and have never been contacted like that. Seems a bit fishy to me.

Ignore, do not respond. Its a way for them to fish into you telling them shit so they can pursue legal pressures/sales regarding your systems. You dont have to tell them shit.

This is "I am looking for licensing audits and revenue" dressed up as "I would like to be helpful and assist with security". Even if it were somebody actually from Oracle (and it could be), a real audit would be more formal and would involve Adobe. I would ignore this.

Yup, Oracle have changed their licensing recently (again!) and they're proactively reaching out to any company that has downloaded a JRE or JDK to try to find non-compliance and "encourage" companies to buy more licenses to come into compliance.

Thanks folks, that's what I suspected. Bleh. Nice company.

Also, if you switch to a non-oracle JDK none of this applies either.

Although Adobe don't certify that CF works on non-Oracle JDKs, right?

some helpful links and resources that will help clear out confusions - https://coldfusion.adobe.com/2023/11/oracle-java-support-for-adobe-coldfusion-2021-2023/ https://helpx.adobe.com/coldfusion/enterprise/faq.html#java-support

Thank you @Charvi, very helpful, what I thought.