Check ID: app_ensure_java_version_is_latest
Provider: Azure
Service: app
Severity: LOW
Categories: vulnerabilities
Resource type: microsoft.web/sites

What this check verifies

Azure App Service web apps that run Java are assessed to ensure their configured runtime uses the latest supported major version (LTS) for the environment, across Linux and Windows. Only apps with Java enabled are considered.

Risk

Using an outdated Java runtime enables known exploits like remote code execution, unsafe deserialization, and cryptographic flaws, risking data theft and tampering (confidentiality, integrity) and outages or takeover (availability). Unsupported versions also delay critical security patches.

Recommendation

Adopt the latest supported LTS Java (java <latest LTS>) and standardize on that major line.
  • Enable automatic minor/patch updates
  • Validate upgrades in a staging environment before production
  • Retire deprecated runtimes and track vendor EOL
Apply change management and defense in depth to reduce exposure.

Remediation

az webapp config set —resource-group <RESOURCE_GROUP> —name <APP_NAME> —linux-fx-version “JAVA|17-java17”

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = app_ensure_java_version_is_latest. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks