FULL PRODUCT VERSION :
java version "1.8.0_40"
Java(TM) SE Runtime Environment (build 1.8.0_40-b26)
Java HotSpot(TM) Client VM (build 25.40-b25, mixed mode)

ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows [Version 6.1.7601]

EXTRA RELEVANT SYSTEM CONFIGURATION :
exception only logged once per day per client. (if ${user.home}\AppData\LocalLow\Sun\Java\Deployment\security\update.securitypack.t‌​imestamp is older than 24 hours).

A DESCRIPTION OF THE PROBLEM :
The jar published at https://javadl-esd-secure.oracle.com/update/securitypack.jar is not signed. I believe this is the cause of the exception.



ADDITIONAL REGRESSION INFORMATION:
This stated on Apr 14th. I suspect when this ticket was handled:

https://bugs.openjdk.java.net/browse/JDK-8077736



STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Launch any web start app with ${user.home}\AppData\LocalLow\Sun\Java\Deployment\security\update.securitypack.t‌​imestamp older than 24 hours. You will see the exception on the console or in an uncaught exception handler.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
no exception.
ACTUAL -
the error below.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
java.lang.SecurityException: Can not verify security pack jar
com.sun.deploy.util.SecurityBaseline.verifyJar(Unknown Source)
com.sun.deploy.util.SecurityBaseline.access$200(Unknown Source)
com.sun.deploy.util.SecurityBaseline$1.run(Unknown Source)
java.lang.Thread.run(Unknown Source)

REPRODUCIBILITY :
This bug can be reproduced often.