I recently upgrade Jira server from 7.3.8 to 7.9.2 and noticed that the version of the JRE was not upgraded. It is still 1.8.0_102, which is a couple years old. I already have an infosec team on case about the old JRE :(
The documentation states that Oracle Java 1.8 is supported, so it seems I should be able to upgrade it myself, but come on, why not also keep the upstream bundled JRE current to enhance the safety of the product?
Michael