We have addressed the key questions regarding the October 2026 Java security update, its impact on Mendix Cloud applications, the rollout of the patched Java runtime, and the actions required to obtain the update.

Q1. Is the Java runtime used by Mendix Cloud affected by the October 2026 Java security vulnerabilities?

Applications built with Java versions up to and including Eclipse Temurin 21.0.12 use a JDK version that predates the October 2026 Oracle/OpenJDK security fixes. The highest-rated server-side Java 21 vulnerability in Oracle's advisory has a CVSS score of 7.0. None of the listed server-side Java 21 vulnerabilities is rated Critical. The exploitability of individual vulnerabilities depends on the Java APIs used by the application and whether untrusted data is processed.

The separate eMudhra certificate issue (CVE-2026-91403) has already been mitigated by Mendix. Further details are available on the Mendix status page.

Q2. When and how will the JDK/JRE used by Mendix Cloud be updated to the patched Temurin version?

The update is now available. As of 23 October 2026, the Mendix Cloud build process includes Eclipse Temurin 21.0.13, which contains the October 2026 security fixes. Since the JDK is included in the application image and selected during the build process, the updated version will be applied the next time the application is built and redeployed.

Q3. Which Java distribution and patch version are used by Mendix Cloud, including Mendix Runtime 10.24.22

Mendix Cloud uses Eclipse Temurin, distributed by Adoptium. The “AdoptOpenJDK” label displayed in the Cloud Portal is the legacy name. The Java version depends on the application's last build time:

• Applications built before 23 October 2026 use Eclipse Temurin 21.0.12.
• Applications built on or after 23 October 2026, at approximately 10:00 UTC, use Eclipse Temurin 21.0.13.

Q5. Is an application redeployment, restart, or Mendix version upgrade required to apply the Java security fixes?

A new application build and redeployment are required to apply the patched Java version. The recommended deployment sequence is Test, Acceptance, and Production. A restart alone does not update the JDK. A Mendix version upgrade is not required solely to obtain the Java security fixes.

Redeployment causes brief downtime while the application restarts. Builds started on or after 23 October 2026, at approximately 10:00 UTC, use Eclipse Temurin 21.0.13.

Q6. Which security advisories and release notes provide further information?

The following references provide additional details about the vulnerabilities, patched Java release, and related Mendix mitigation:

• Oracle Critical Patch Update – October 2026
• OpenJDK Vulnerability Advisory – 20 October 2026
• Eclipse Temurin 21.0.13 Release
• Security update: Critical Java patch update

Summary: Eclipse Temurin 21.0.13, containing the October 2026 Java security fixes, is available in the Mendix Cloud build process from 23 October 2026, at approximately 10:00 UTC. Applications built before this time require a new build and redeployment to obtain the patched JDK. No Mendix version upgrade is required.