diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8c370dbe7b0d9..7f4a6f38b578e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -36,6 +36,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - OpenJDK Update (April 2023 Patch releases) ([#7344](https://github.com/opensearch-project/OpenSearch/pull/7344)
 - Bump `com.google.http-client:google-http-client:1.43.2` from 1.42.0 to 1.43.2 ([7928](https://github.com/opensearch-project/OpenSearch/pull/7928)))
 - Add Opentelemetry dependencies ([#7543](https://github.com/opensearch-project/OpenSearch/issues/7543))
+- Bump `org.bouncycastle:bcprov-jdk15on` to `org.bouncycastle:bcprov-jdk15to18` version 1.75 ([8247](https://github.com/opensearch-project/OpenSearch/pull/8247))
+- Bump `org.bouncycastle:bcmail-jdk15on` to `org.bouncycastle:bcmail-jdk15to18` version 1.75 ([8247](https://github.com/opensearch-project/OpenSearch/pull/8247))
+- Bump `org.bouncycastle:bcpkix-jdk15on` to `org.bouncycastle:bcpkix-jdk15to18` version 1.75 ([8247](https://github.com/opensearch-project/OpenSearch/pull/8247))
+
+
 
 ### Changed
 - [CCR] Add getHistoryOperationsFromTranslog method to fetch the history snapshot from translogs ([#3948](https://github.com/opensearch-project/OpenSearch/pull/3948))
diff --git a/buildSrc/version.properties b/buildSrc/version.properties
index 735a9fe4f8255..f9eac9516cb18 100644
--- a/buildSrc/version.properties
+++ b/buildSrc/version.properties
@@ -48,7 +48,7 @@ reactivestreams   = 1.0.4
 # when updating this version, you need to ensure compatibility with:
 #  - plugins/ingest-attachment (transitive dependency, check the upstream POM)
 #  - distribution/tools/plugin-cli
-bouncycastle=1.70
+bouncycastle=1.75
 # test dependencies
 randomizedrunner  = 2.7.1
 junit             = 4.13.2
diff --git a/plugins/identity-shiro/build.gradle b/plugins/identity-shiro/build.gradle
index 22dc21864b620..baa3464d0a98e 100644
--- a/plugins/identity-shiro/build.gradle
+++ b/plugins/identity-shiro/build.gradle
@@ -28,7 +28,7 @@ dependencies {
 
   implementation 'org.passay:passay:1.6.3'
 
-  implementation "org.bouncycastle:bcprov-jdk15on:${versions.bouncycastle}"
+  implementation "org.bouncycastle:bcprov-jdk15to18:${versions.bouncycastle}"
 
   testImplementation project(path: ':modules:transport-netty4') // for http
   testImplementation project(path: ':plugins:transport-nio') // for http
diff --git a/plugins/identity-shiro/licenses/bcprov-jdk15on-1.70.jar.sha1 b/plugins/identity-shiro/licenses/bcprov-jdk15on-1.70.jar.sha1
deleted file mode 100644
index f5e89c0f5ed45..0000000000000
--- a/plugins/identity-shiro/licenses/bcprov-jdk15on-1.70.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-4636a0d01f74acaf28082fb62b317f1080118371
\ No newline at end of file
diff --git a/plugins/identity-shiro/licenses/bcprov-jdk15to18-1.75.jar.sha1 b/plugins/identity-shiro/licenses/bcprov-jdk15to18-1.75.jar.sha1
new file mode 100644
index 0000000000000..9911bb75f9209
--- /dev/null
+++ b/plugins/identity-shiro/licenses/bcprov-jdk15to18-1.75.jar.sha1
@@ -0,0 +1 @@
+df22e1b6a9f6b218913f5b68dd16641344397fe0
\ No newline at end of file
diff --git a/plugins/identity-shiro/licenses/bcprov-jdk15on-LICENSE.txt b/plugins/identity-shiro/licenses/bcprov-jdk15to18-LICENSE.txt
similarity index 100%
rename from plugins/identity-shiro/licenses/bcprov-jdk15on-LICENSE.txt
rename to plugins/identity-shiro/licenses/bcprov-jdk15to18-LICENSE.txt
diff --git a/plugins/identity-shiro/licenses/bcprov-jdk15on-NOTICE.txt b/plugins/identity-shiro/licenses/bcprov-jdk15to18-NOTICE.txt
similarity index 100%
rename from plugins/identity-shiro/licenses/bcprov-jdk15on-NOTICE.txt
rename to plugins/identity-shiro/licenses/bcprov-jdk15to18-NOTICE.txt
diff --git a/plugins/ingest-attachment/build.gradle b/plugins/ingest-attachment/build.gradle
index 1f3c80909733c..62651216c8144 100644
--- a/plugins/ingest-attachment/build.gradle
+++ b/plugins/ingest-attachment/build.gradle
@@ -71,9 +71,9 @@ dependencies {
   api "org.apache.pdfbox:fontbox:${versions.pdfbox}"
   api "org.apache.pdfbox:jempbox:1.8.17"
   api "commons-logging:commons-logging:${versions.commonslogging}"
-  api "org.bouncycastle:bcmail-jdk15on:${versions.bouncycastle}"
-  api "org.bouncycastle:bcprov-jdk15on:${versions.bouncycastle}"
-  api "org.bouncycastle:bcpkix-jdk15on:${versions.bouncycastle}"
+  api "org.bouncycastle:bcmail-jdk15to18:${versions.bouncycastle}"
+  api "org.bouncycastle:bcprov-jdk15to18:${versions.bouncycastle}"
+  api "org.bouncycastle:bcpkix-jdk15to18:${versions.bouncycastle}"
   // OpenOffice
   api "org.apache.poi:poi-ooxml:${versions.poi}"
   api "org.apache.poi:poi:${versions.poi}"
diff --git a/plugins/ingest-attachment/licenses/bcmail-jdk15on-1.70.jar.sha1 b/plugins/ingest-attachment/licenses/bcmail-jdk15on-1.70.jar.sha1
deleted file mode 100644
index 672e479eda8d7..0000000000000
--- a/plugins/ingest-attachment/licenses/bcmail-jdk15on-1.70.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-08f4aafad90f6cc7f16b9992279828ae848c9e0d
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/bcmail-jdk15to18-1.75.jar.sha1 b/plugins/ingest-attachment/licenses/bcmail-jdk15to18-1.75.jar.sha1
new file mode 100644
index 0000000000000..e6840a9b02b38
--- /dev/null
+++ b/plugins/ingest-attachment/licenses/bcmail-jdk15to18-1.75.jar.sha1
@@ -0,0 +1 @@
+b316bcd094e3917b1ece93a6edbab93f8315fb3b
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/bcmail-jdk15on-LICENSE.txt b/plugins/ingest-attachment/licenses/bcmail-jdk15to18-LICENSE.txt
similarity index 100%
rename from plugins/ingest-attachment/licenses/bcmail-jdk15on-LICENSE.txt
rename to plugins/ingest-attachment/licenses/bcmail-jdk15to18-LICENSE.txt
diff --git a/plugins/ingest-attachment/licenses/bcmail-jdk15on-NOTICE.txt b/plugins/ingest-attachment/licenses/bcmail-jdk15to18-NOTICE.txt
similarity index 100%
rename from plugins/ingest-attachment/licenses/bcmail-jdk15on-NOTICE.txt
rename to plugins/ingest-attachment/licenses/bcmail-jdk15to18-NOTICE.txt
diff --git a/plugins/ingest-attachment/licenses/bcpkix-jdk15on-1.70.jar.sha1 b/plugins/ingest-attachment/licenses/bcpkix-jdk15on-1.70.jar.sha1
deleted file mode 100644
index e348463a21257..0000000000000
--- a/plugins/ingest-attachment/licenses/bcpkix-jdk15on-1.70.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-f81e5af49571a9d5a109a88f239a73ce87055417
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/bcpkix-jdk15to18-1.75.jar.sha1 b/plugins/ingest-attachment/licenses/bcpkix-jdk15to18-1.75.jar.sha1
new file mode 100644
index 0000000000000..9181b1c3ab1b6
--- /dev/null
+++ b/plugins/ingest-attachment/licenses/bcpkix-jdk15to18-1.75.jar.sha1
@@ -0,0 +1 @@
+f16e5252ad7a46d5eaf255231b0a5da307599082
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/bcpkix-jdk15on-LICENSE.txt b/plugins/ingest-attachment/licenses/bcpkix-jdk15to18-LICENSE.txt
similarity index 100%
rename from plugins/ingest-attachment/licenses/bcpkix-jdk15on-LICENSE.txt
rename to plugins/ingest-attachment/licenses/bcpkix-jdk15to18-LICENSE.txt
diff --git a/plugins/ingest-attachment/licenses/bcpkix-jdk15on-NOTICE.txt b/plugins/ingest-attachment/licenses/bcpkix-jdk15to18-NOTICE.txt
similarity index 100%
rename from plugins/ingest-attachment/licenses/bcpkix-jdk15on-NOTICE.txt
rename to plugins/ingest-attachment/licenses/bcpkix-jdk15to18-NOTICE.txt
diff --git a/plugins/ingest-attachment/licenses/bcprov-jdk15on-1.70.jar.sha1 b/plugins/ingest-attachment/licenses/bcprov-jdk15on-1.70.jar.sha1
deleted file mode 100644
index f5e89c0f5ed45..0000000000000
--- a/plugins/ingest-attachment/licenses/bcprov-jdk15on-1.70.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-4636a0d01f74acaf28082fb62b317f1080118371
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/bcprov-jdk15to18-1.75.jar.sha1 b/plugins/ingest-attachment/licenses/bcprov-jdk15to18-1.75.jar.sha1
new file mode 100644
index 0000000000000..9911bb75f9209
--- /dev/null
+++ b/plugins/ingest-attachment/licenses/bcprov-jdk15to18-1.75.jar.sha1
@@ -0,0 +1 @@
+df22e1b6a9f6b218913f5b68dd16641344397fe0
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/bcprov-jdk15on-LICENSE.txt b/plugins/ingest-attachment/licenses/bcprov-jdk15to18-LICENSE.txt
similarity index 100%
rename from plugins/ingest-attachment/licenses/bcprov-jdk15on-LICENSE.txt
rename to plugins/ingest-attachment/licenses/bcprov-jdk15to18-LICENSE.txt
diff --git a/plugins/ingest-attachment/licenses/bcprov-jdk15on-NOTICE.txt b/plugins/ingest-attachment/licenses/bcprov-jdk15to18-NOTICE.txt
similarity index 100%
rename from plugins/ingest-attachment/licenses/bcprov-jdk15on-NOTICE.txt
rename to plugins/ingest-attachment/licenses/bcprov-jdk15to18-NOTICE.txt
diff --git a/plugins/ingest-attachment/src/main/plugin-metadata/plugin-security.policy b/plugins/ingest-attachment/src/main/plugin-metadata/plugin-security.policy
index 0fa85f6f040f6..4b90f9a21aae4 100644
--- a/plugins/ingest-attachment/src/main/plugin-metadata/plugin-security.policy
+++ b/plugins/ingest-attachment/src/main/plugin-metadata/plugin-security.policy
@@ -35,9 +35,6 @@ grant {
   // needed to apply additional sandboxing to tika parsing
   permission java.security.SecurityPermission "createAccessControlContext";
 
-  // TODO: fix PDFBox not to actually install bouncy castle like this
-  permission java.security.SecurityPermission "putProviderProperty.BC";
-  permission java.security.SecurityPermission "insertProvider";
   // TODO: fix POI XWPF to not do this: https://bz.apache.org/bugzilla/show_bug.cgi?id=58597
   permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
   // needed by xmlbeans, as part of POI for MS xml docs
diff --git a/test/fixtures/hdfs-fixture/build.gradle b/test/fixtures/hdfs-fixture/build.gradle
index de6f69a4fd4ce..310b088674d5c 100644
--- a/test/fixtures/hdfs-fixture/build.gradle
+++ b/test/fixtures/hdfs-fixture/build.gradle
@@ -51,7 +51,7 @@ dependencies {
   api "org.apache.logging.log4j:log4j-core:${versions.log4j}"
   api "io.netty:netty-all:${versions.netty}"
   api 'com.google.code.gson:gson:2.10.1'
-  api "org.bouncycastle:bcpkix-jdk15on:${versions.bouncycastle}"
+  api "org.bouncycastle:bcpkix-jdk15to18:${versions.bouncycastle}"
   api "com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider:${versions.jackson}"
   api "com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}"
   api "com.fasterxml.woodstox:woodstox-core:${versions.woodstox}"