Place the Java 7 host on an isolated VLAN with no internet access. Restrict inbound traffic to specific source IPs. Block all outbound traffic except to the legacy application server.
While specific CVEs number in the hundreds, the risks associated with Java 7u80 generally fall into these high-impact categories: java 7 update 80 vulnerabilities
Since Update 80 is no longer maintained, it is susceptible to several modern exploit categories: Java 7 vulnerabilities in update 80? - Oracle Forums Place the Java 7 host on an isolated