Having been in environments that still needed to support JRE6 and be secure, the support contract from Oracle is actually not horribly priced and is actively fixing CVE's that are not available to the public.