Overview
Xerox's January 2026 security materials do not apply the same Java update to every FreeFlow release. The v2 and v7 bulletins include OpenJDK 8 Update 482-b08 and list CVE-2026-21932. The v9 bulletin provides no Java update and does not list the CVE. The version split is the first fact an administrator should establish before choosing a remedy.
Oracle record
Oracle published CVE-2026-21932 on January 20, 2026. It affects AWT and JavaFX in Java SE, GraalVM for JDK and GraalVM Enterprise Edition. Oracle gives the issue CVSS 3.1 score 7.4, CWE-1287 and a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N.
Affected Java SE releases are 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9 and 25.0.1. GraalVM for JDK 17.0.17 and 21.0.9 and GraalVM Enterprise Edition 21.3.16 are listed as well.
Oracle's note says the issue applies to clients that run sandboxed Java Web Start applications or applets with untrusted code. It does not apply to server deployments that run only trusted code. The public record does not identify the precise AWT or JavaFX input.
Mechanism and exploitation conditions
Oracle's public description does not expose the faulty AWT or JavaFX operation. It does define the attack conditions: network access, low complexity, no privileges and interaction by a person other than the attacker. The client-side Java sandbox note matters when deciding whether a FreeFlow installation matches the published scenario.
FreeFlow v2 on Windows 10
Xerox Security Bulletin XRX26-007 is dated February 24, 2026. It covers the January 2026 Security Patch Update for FreeFlow Print Server v2 on Windows 10. The package replaces OpenJDK Java 8 Update 472-b08 with Update 482-b08.
The bulletin lists CVE-2026-21932 under the OpenJDK remediation table. It names support for iGen 5 and Baltoro HF Production Inkjet Press products. Xerox recommends scheduling the update through its service organization, while allowing a customer to use approved Windows update services with Xerox guidance.
FreeFlow v7 on Solaris 11.4
Xerox Security Bulletin XRX26-006 is dated February 20, 2026. It covers the January 2026 Security Patch Cluster for FreeFlow v7 on Solaris 11.4. The cluster also supersedes OpenJDK Java 8 Update 472-b08 with Update 482-b08 and lists CVE-2026-21932.
The v7 package is intended for FFPS 73.M1.90 / RV 14.4.28 and later software levels. Xerox identifies FFPS 73.P3.25 / RV 14.5.37.01 as the latest release at the time of the bulletin and names Nuvera 120, 144, 157, 288 and 314 press families in the tested scope.
FreeFlow v9
Security Bulletin XRX26-009 covers a January 2026 Security Patch Cluster for FreeFlow v9 on Solaris 10, but it explicitly says there is no Java software update. Its remediation table does not include CVE-2026-21932. Administrators should not infer that the v9 package removes this Java issue.
Exposure evidence
ZoomEye returned 197 product-title matches for title="FreeFlow" and no results for vul.cve="CVE-2026-21932". The larger count is 197 and represents title-level product exposure, not confirmed vulnerable versions.
https://www.zoomeye.ai/searchResult?q=dGl0bGU9IkZyZWVGbG93Ig%3D%3D
The result cannot distinguish v2, v7 and v9 by itself. Asset owners need local version and Java inventory.
Remediation matrix
For v2 on Windows 10, use the January 2026 Security Patch Update described in XRX26-007. For v7 on Solaris 11.4, use the January 2026 Security Patch Cluster in XRX26-006. For v9, follow Xerox support guidance for the installed platform and do not present the v9 January package as a Java fix for this CVE.
After patching, record the FreeFlow release, patch package and OpenJDK version. Limit network reachability and user ability to launch untrusted Java content until the correct package is verified.