Legacy Java Data Risk

Is Java-the-VM really that vulnerable? There are plenty of attacks on Java-the-web-plugin, but those wouldn't affect corporate deployments.