Cortex XDR cyjagent.dll injection causes JVM startup crash (EXCEPTION_ACCESS_VIOLATION in ntdll.dll)

[aravindhanr68]

We run an enterprise Java server application (Zulu OpenJDK 11, Windows Server) and are seeing consistent JVM crashes at startup on hosts protected by Cortex XDR. The agent injects cyjagent.dll (Java Deserialization Protection module) into the Java process, and the JVM crashes in native code:

# EXCEPTION_ACCESS_VIOLATION (0xc0000005)

# Problematic frame: C [ntdll.dll+0x17f35]

# JRE: Zulu OpenJDK 11.0.25+9-LTS, 64-bit Server VM, windows-amd64

Command line includes: -agentpath:C:\Program Files\Palo Alto Networks\Traps\cyjagent.dll

The crash reproduces on every service start while the injection is active, and disappears when the Java process is excluded from the XDR policy. We've confirmed the same pattern on multiple independent hosts — the only common factor is the cyjagent injection. Process exclusion isn't an acceptable long-term state for this server, so we're looking for a proper resolution.

Questions:

Is this a known issue with cyjagent in any specific Cortex XDR agent version? Is there a version where it's fixed?
Is there recommended configuration for the Java Deserialization Protection module (other than full process exclusion) to avoid the crash?
What information would help PA investigate? We can provide full hs_err_pid logs and minidumps via a TAC case.

[susekar]

Hello @aravindhanr68 ,

Greetings for the day.

This is a known issue that can occur due to a conflict between the Cortex XDR Java Deserialization Protection (JDP) module and certain JVM initialization or termination sequences.

Known fixes:

• CPATR-38467: Resolved in Cortex XDR Agent 9.2.1 and 9.1.101-CE.
• CPATR-18158: Resolved in Cortex XDR Agent 8.3.101.53522 CE and 8.6.1.

Recommended approach:

• Upgrade the Cortex XDR Agent to a fixed version, if possible.
• If an upgrade is not immediately possible, a targeted Support Exception (SUEX) can be used to disable only the affected Java hooks while keeping the remaining JDP protection enabled.
• As an alternative, protection can be disabled specifically for the affected Java process through an Operational Agent Exception.
  
  

The preferred approach is to upgrade to a fixed agent version or use a targeted exception rather than excluding the entire Java process.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar