Oracle has reduced Java subscription prices for smaller organisations. For some, the difference is substantial: an organisation with 500 employees would now pay $10,000 annually instead of $90,000, based on published list prices.
That changes the commercial calculation. It leaves an important management question unanswered: who ensures that every Java instalation supporting the business remains supported and up to date?
On 8 October 2026, Oracle announced new Java SE Universal Subscription pricing for organisations with fewer than 3,000 employees. Enterprise pricing for organisations with 3,000 or more employees remains unchanged.The examples below illustrate the impact:
| Employees | Previous annual cost | New annual cost | Reduction |
| 100 | $18,000 | $1,000 | 94.4% |
| 500 | $90,000 | $10,000 | 88.9% |
| 800 | $144,000 | $54,160 | 62.4% |
| 2,000 | $288,000 | $230,800 | 19.9% |
Annual costs in USD, calculated using published list prices without negotiated discounts. Employee counts follow Oracle’s contractual definition, including relevant external personnel. For 501–2,999 employees, the new calculation is $10,000 annually plus $147.20 for each employee above 500.
The pricing bands and conditions are available in Oracle’s Java SE Universal Subscription Global Price List.
For organisations considering a subscription, these reductions may make purchasing Oracle Java more attractive. Existing customers may also want to reassess their commercial options.
However, organisations should avoid treating a subscription purchase as the completion of their Java risk assessment.
A subscription can establish contractual coverage for the agreed scope and provide access to support and security updates. The organisation must still identify its instalations, understand their application dependencies, and ensure that those updates are actually deployed.
Java is often embedded in third-party applications, instaled centrally on servers, downloaded onto desktops, or included in containers and system images. Several distributions and update levels can coexist within the same environment.
Historically, Java frequently arrived without a separate procurement decision. An application needed it, a supplier recommended it, or a user instaled it. Consequently, responsibility for the runtime did not always become part of an established licencing or security process.
Application management may know which software requires Java. Infrastructure teams may manage the servers. Security may identify vulnerabilities, while software asset management reviews licencing. Each team holds part of the picture.
Without coordination, outdated instalations and unclear responsibilities can persist for years.
Oracle’s changes to Java 8 licencing in 2019 brought commercial exposure into sharper focus. The employee-based Universal Subscription introduced in January 2023 increased that attention further. Yet some organisations still struggle to establish their licencing position.
Seven years after the 2019 changes, an unresolved compliance assessment should prompt a broader review. It does not automatically establish a security failure, but both assessments depend on knowing where Java runs, which build is present and what uses it.
If that information remains incomplete, how confidently can management assess whether Java receives appropriate security maintenance?
Recent incidents in the retail sector demonstrate how directly software security can affect business operations.
Albert Heijn reported a cybersecurity incident beginning on 11 October 2026 and temporarily shut down systems as a precaution. Its initial statement described unavailable digital services, interrupted logistics, and suspended home deliveries.
In France, attacks on supermarket refrigeration systems reportedly caused temperatures to reach 50°C, forcing retailers to discard products. CERT-FR confirmed numerous compromises of refrigeration controllers and warned about internet-exposed management interfaces and equipment without security fixes.
The cited information does not establish Java as the cause of these incidents. They illustrate the wider business consequences of compromised systems: interrupted operations, lost stock and recovery work.
Java deserves attention wherever it supports applications with similarly important business dependencies. Depending on the environment, a successful attack could expose sensitive information, enable ransomware or interrupt essential services. Those consequences can exceed the annual cost of a software subscription.
AI adds urgency. The UK National Cyber Security Centre assesses that AI will make elements of cyber intrusion more effective and efficient, including vulnerability research and exploit development. It also expects AI to increase attackers’ ability to exploit known vulnerabilities, putting further pressure on organisations to address outdated systems promptly.
At SoftwareOne, we increasingly see security becoming a primary driver for reviewing the Java estate alongside compliance and cost.
This also changes how migration should be approached. Replacing Oracle Java with an alternative distribution can reduce commercial dependency. The replacement still needs current security updates, application validation, and an accountable owner.
Supplier support matters. A technically compatible runtime may fall outside the application publisher’s documented support conditions. The appropriate target is a supported distribution and Java release with current applicable security updates, validated against the application’s requirements.
A coordinated programme should therefore cover five connected activities:
Delivery requires project leadership, executive sponsorship, and cooperation across application management, infrastructure, security, and licencing. External expertise can help resolve complex dependencies and accelerate progress. Ongoing ownership must remain part of regular operations.
Oracle’s new pricing gives smaller organisations a reason to revisit their purchasing decisions. Every organisation, regardless of size or distribution choice, still needs a reliable view of its Java estate.
The opportunity is to reduce avoidable licencing expenditure while strengthening security and business continuity.
SoftwareOne’s Java Advisory Services can help establish that foundation and identify the next steps. Contact your SoftwareOne representative to discuss how your organisation can combine Java cost optimisation with sustained security management.
Build visibility across your Java estate, reduce avoidable licencing costs, and maintain supported security updates.
Build visibility across your Java estate, reduce avoidable licencing costs, and maintain supported security updates.
