Executive Summary

  • Oracle intends to provide Java security updates more frequently than the current quarterly CPU cadence of January, April, July, and October.
  • Oracle is targeting a monthly update for August 18, 2026, in addition to the regularly scheduled July and October CPU releases.
  • We plan to provide multiple monthly updates in CY27; organizations should be preparing for this cadence.

Details

Oracle’s Integrated Cyber Center (ICC) team recently published a blog describing plans to offer targeted monthly Critical Security Patch Updates (CSPUs). CSPUs are intended to provide an opportunity every month for targeted fixes that address high-priority vulnerabilities, instead of having to wait until the next quarterly CPU. The rationale is clear: the latest generation of AI is transforming how software vulnerabilities are identified and fixed, increasing the speed and scale of discovery and remediation.
 
We intend to shift the Java security update processes over the coming year towards a monthly cadence. The focus of these monthly updates is on security and stability fixes, not new features. An initial CSPU schedule for Oracle products is available. It follows the CPU pattern aligning release dates to the third Tuesday of each month. Oracle is currently planning a Java CSPU for August 18th, in addition to our regularly scheduled July and October CPU releases. To help with planning, we plan to provide updates on future releases before the October CPU via updates to this blog and other support channels.

More frequent security updates will mean that users need to patch their Java installations more often to remain on the Java security baseline. Organizations that deliver applications bundled with a JDK or JRE may also need to assess how a faster update cadence affects their build, test, release, and deployment processes. For that reason, we are announcing our plans for a faster Java update cadence in calendar year 2027 now. This lead time, together with the details provided here, is intended to help Java users, application developers, and organizations plan and prepare for the change.

Subscribe to receive email notifications when there is a Java CSPU, CPU, and for other Oracle Security Alerts.