Check ID:
Provider: Azure
Service:
Severity: LOW
Categories:
Resource type:
app_ensure_java_version_is_latestProvider: Azure
Service:
appSeverity: LOW
Categories:
vulnerabilitiesResource type:
microsoft.web/sitesWhat this check verifies
Azure App Service web apps that run Java are assessed to ensure their configured runtime uses the latest supported major version (LTS) for the environment, across Linux and Windows. Only apps with Java enabled are considered.Risk
Using an outdated Java runtime enables known exploits like remote code execution, unsafe deserialization, and cryptographic flaws, risking data theft and tampering (confidentiality, integrity) and outages or takeover (availability). Unsupported versions also delay critical security patches.Recommendation
Adopt the latest supported LTS Java (java <latest LTS>) and standardize on that major line.
- Enable automatic minor/patch updates
- Validate upgrades in a staging environment before production
- Retire deprecated runtimes and track vendor EOL
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az webapp config set —resource-group <RESOURCE_GROUP> —name <APP_NAME> —linux-fx-version “JAVA|17-java17”
References
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/AppService/latest-version-of-java.html
- https://learn.microsoft.com/en-us/azure/app-service/configure-language-java?pivots=platform-linux#choosing-a-java-runtime-version
- https://learn.microsoft.com/en-us/azure/app-service/configure-common?tabs=portal#general-settings
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = app_ensure_java_version_is_latest. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks