Oracle recently released the June 2026 Critical Security Patch Updates (CSPUs), reinforcing our commitment to helping customers protect their JD Edwards environments. CSPUs provide smaller, monthly security releases that deliver targeted fixes for critical vulnerabilities between Oracle’s traditional quarterly Critical Patch Updates (CPUs).

For JD Edwards customers, Critical Security Patch Updates offer a faster path to closing critical security gaps, reducing exposure windows, and improving response agility.

Oracle JD Edwards Risk Matrix

Oracle’s Critical Security Patch Update Advisory for June 2026 includes important security updates for JD Edwards products. This Critical Security Patch Update contains 20 new security patches for Oracle JD Edwards. 12 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials. The English text form of this Risk Matrix can be found here.

Why are Oracle CSPUs essential for customers?

Reduces exposure to threats: Monthly CSPUs provide a faster path for addressing critical JD Edwards vulnerabilities between Oracle’s quarterly CPUs, reducing the time that known vulnerabilities remain unpatched. CSPUs complement the quarterly CPU process, so customers should continue normal CPU planning while evaluating each monthly CSPU for applicability.

Better protection for JD Edwards and supporting technology stacks: JD Edwards CSPUs address JD Edwards fixes. Customers should also review and apply the corresponding CSPUs or CPUs for supporting components such as Oracle Database, WebLogic Server, Java, middleware, operating systems, integrations, and other third-party components used in their environments.

Improved compliance and audit readiness: If your organization is required to demonstrate timely remediation of critical vulnerabilities, monthly CSPUs provide a mechanism to address them sooner and support stronger vulnerability management practices.

Steps for JD Edwards customers

While Oracle addresses vulnerabilities in supported Oracle code and third-party components included in Oracle products through CSPUs and CPUs, customers play a critical role in protecting their own environments. Staying current on supported releases and technology components, including operating systems, databases, WebLogic Server, and Java, helps reduce exposure and prepares organizations for today’s security challenges.

Maintaining patch discipline and system hardening is key:

  • Stay current with JD Edwards Electronic Software Updates (ESUs), and Tools Releases, OS, Database, WebLogic, and Java patches
  • Regularly apply applicable security patches from Oracle CSPUs and CPUs
  • Harden infrastructure and disable unused ports/services
  • Secure WebLogic configurations and enforce JDENET TLS/HTTPS/FTPS/SMTPS/TCPS for databases
  • Disable non-secure HTTP/FTP/SMTP/TCP for databases and validate patching in non-production before rollout

In JD Edwards environments, whether on-premises or hosted in cloud environments such as OCI, GCP, AWS, or Azure, security resilience relies on a combination of strong access controls, secure configuration, continuous monitoring, and disciplined operational practices using One Click Provisioning, Security Workbench application, security history, and Server Manager. Measures and best practices to strengthen security for your enterprise are detailed in this MOS document.

JD Edwards customers using Oracle-managed cloud services benefit from continuous security monitoring and remediation. As vulnerabilities are discovered, Oracle applies appropriate fixes across its cloud infrastructure, platform, and application services, helping customers stay protected without managing the patching process themselves.

Oracle develops and delivers security patches for supported products, while customers retain responsibility for determining when and how those updates are applied within their environments, whether those deployments run on-premises, on OCI, through Oracle-managed cloud services, or on other cloud platforms. Learn more about how Oracle is Accelerating Vulnerability Detection and Response.

How can JD Edwards partners help?

JD Edwards partners can play an important role in helping you evaluate and respond to CSPUs. By reviewing your technology inventory and supported product versions, JD Edwards partners can help assess which updates apply to the environment, prioritize remediation activities, and help align testing and deployment plans with Oracle’s monthly CSPU and quarterly CPU release cadence.

For more information, see the Oracle Security Blog.