Cortex XDR cyjagent.dll injection causes JVM startup crash (EXCEPTION_ACCESS_VIOLATION in ntdll.dll)

aravindhanr68 — Wed, 12 Aug 2026 08:41:26 GMT

We run an enterprise Java server application (Zulu OpenJDK 11, Windows Server) and are seeing consistent JVM crashes at startup on hosts protected by Cortex XDR. The agent injects cyjagent.dll (Java Deserialization Protection module) into the Java process, and the JVM crashes in native code:

# EXCEPTION_ACCESS_VIOLATION (0xc0000005)

# Problematic frame: C [ntdll.dll+0x17f35]

# JRE: Zulu OpenJDK 11.0.25+9-LTS, 64-bit Server VM, windows-amd64

Command line includes: -agentpath:C:\Program Files\Palo Alto Networks\Traps\cyjagent.dll

The crash reproduces on every service start while the injection is active, and disappears when the Java process is excluded from the XDR policy. We've confirmed the same pattern on multiple independent hosts — the only common factor is the cyjagent injection. Process exclusion isn't an acceptable long-term state for this server, so we're looking for a proper resolution.

Questions:

Is this a known issue with cyjagent in any specific Cortex XDR agent version? Is there a version where it's fixed?
Is there recommended configuration for the Java Deserialization Protection module (other than full process exclusion) to avoid the crash?
What information would help PA investigate? We can provide full hs_err_pid logs and minidumps via a TAC case.

topic Cortex XDR cyjagent.dll injection causes JVM startup crash (EXCEPTION_ACCESS_VIOLATION in ntdll.dll) in Cortex XDR Discussions

Cortex XDR cyjagent.dll injection causes JVM startup crash (EXCEPTION_ACCESS_VIOLATION in ntdll.dll)