We have an agent application deployed to some internal web servers that runs on java, and installs a specific JRE to use. The agent updates regularly and installs updated JRE versions to use, but doesn't remove the old files.
Our security team gets a notification that this in insecure even if secure versions are installed and in use - specifically: https://www.tenable.com/plugins/nessus/92517
What kind of risks are there to having old JREs installed, even if not in use by any application?
To clarify: my understanding is that Java exploits target running processes, applications or the jre/jdk installers, and that the JRE files aren't more or less insecure than any other programming language's source files. Is there an attack vector in which having JRE files on a box is more dangerous than having bash installed?