This blog was originally posted on July 20, 2026 and has been updated on September 10, 2026 with additional update plans.

Executive Summary

  • Oracle intends to provide Java security updates more frequently than the current quarterly CPU cadence of January, April, July, and October.
  • [UPDATED September 10, 2026] Oracle released a monthly security update on August 18, 2026. Oracle is targeting a monthly update for November 17, 2026, in addition to the regularly scheduled October and January CPU releases.
  • We plan to provide multiple monthly updates in CY27; organizations should be preparing for this cadence.

Details

Oracle’s Integrated Cyber Center (ICC) team recently published a blog describing plans to offer targeted monthly Critical Security Patch Updates (CSPUs). CSPUs are intended to provide an opportunity every month for targeted fixes that address high-priority vulnerabilities, instead of having to wait until the next quarterly CPU. The rationale is clear: the latest generation of AI is transforming how software vulnerabilities are identified and fixed, increasing the speed and scale of discovery and remediation.
 
We intend to shift the Java security update processes over the coming year towards a monthly cadence. The focus of these monthly updates is on security and stability fixes, not new features. An initial CSPU schedule for Oracle products is available. It follows the CPU pattern aligning release dates to the third Tuesday of each month. [UPDATED September 10, 2026] Oracle released a monthly security update on August 18, 2026. Oracle is currently planning a Java CSPU for November 17th, in addition to our regularly scheduled October and January CPU releases. To help with planning, we plan to provide updates on future releases before the January CPU via updates to this blog and other support channels.

More frequent security updates will mean that users need to patch their Java installations more often to remain on the Java security baseline. Organizations that deliver applications bundled with a JDK or JRE may also need to assess how a faster update cadence affects their build, test, release, and deployment processes. For that reason, we are announcing our plans for a faster Java update cadence in calendar year 2027 now. This lead time, together with the details provided here, is intended to help Java users, application developers, and organizations plan and prepare for the change.

Subscribe to receive email notifications when there is a Java CSPU, CPU, and for other Oracle Security Alerts.