--- title: Azul August 2026 Release: Java’s First Monthly CSPU description: Azul shipped the first monthly Critical Security Patch Update (CSPU) in Java's history in August 2026, covering Java 26, 25, 21, 17, 11, 8 (Core/Zulu) and Java... canonical: https://daily.dev/posts/azul-august-2026-release-java-s-first-monthly-cspu-mqtul4k9h twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Azul August 2026 Release: Java’s First Monthly CSPU | daily.dev og:description: Azul shipped the first monthly Critical Security Patch Update (CSPU) in Java's history in August 2026, covering Java 26, 25, 21, 17, 11, 8 (Core/Zulu) and Java... og:url: https://daily.dev/posts/azul-august-2026-release-java-s-first-monthly-cspu-mqtul4k9h og:image: https://api.daily.dev/og/posts/mQTUl4k9h.png og:image:alt: Azul August 2026 Release: Java’s First Monthly CSPU og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Azul August 2026 Release: Java’s First Monthly CSPU **[Foojay.io](https://daily.dev/sources/foojayio)** · 5 min read · 1 upvotes · 0 comments ## Summary Azul shipped the first monthly Critical Security Patch Update (CSPU) in Java's history in August 2026, covering Java 26, 25, 21, 17, 11, 8 (Core/Zulu) and Java 25, 21, 17, 11, 8 (Prime/Zing). CSPUs are narrow security-and-stability-only releases published on the third Tuesday of months without a quarterly update, closing the gap where a critical fix could otherwise wait up to three months. Azul splits builds into CPU (security-only, recommended for production) and PSU (security plus accumulated non-security fixes, recommended for testing before rollout, and the only line available to free Zulu Community users). This release fixes five CVEs, four affecting Zulu builds, including one high and two medium severity issues touching 2D rendering, outbound HTTP, and TLS. Teams are advised to default to CPU builds in production and build automation to pick up releases as they land rather than on a fixed calendar date. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between a CSPU CPU build and a CSPU PSU build in Azul Java releases? A CSPU CPU build contains only critical and security fixes layered on the previous quarterly Critical Patch Update, changing as little as possible so it can move to production fast with minimal retesting. A CSPU PSU build layers on the previous quarterly Patch Set Update and also includes accumulated non-security fixes; it is recommended for testing first, and it is the only line available to free Zulu Community (CA) users. _Teams deciding how to roll out JVM patches can track Azul's CPU versus PSU guidance on daily.dev._ ### How often does Azul release Critical Security Patch Updates (CSPU) for Java now? Azul now issues CSPUs monthly, published on the third Tuesday of any month that does not already have a quarterly release. The August 2026 release was the first monthly CSPU in Java's history, covering Java 26, 25, 21, 17, 11, 8, with backports to 7 and 6 for Core, and Java 25, 21, 17, 11, 8 for the Prime (Zing) line. _Developers scheduling JVM upgrades can follow Azul's monthly patch cadence changes on daily.dev._ ### Which CVEs did Azul's August 2026 Java CSPU fix? The August 2026 CSPU fixed five CVEs, four of which apply to Azul Zulu builds: CVE-2026-61308, CVE-2026-70907, CVE-2026-60589, and CVE-2026-62574, rated one high, two medium, and one low severity. Workloads touching 2D rendering, outbound HTTP, or TLS are flagged as the areas most likely affected by the higher-scoring issues. _Teams assessing JVM exposure to new CVEs can check Azul's security patch details on daily.dev._ ## Similar posts on daily.dev - [Azul Zulu July 2026 Quarterly Update Released](https://daily.dev/posts/azul-zulu-july-2026-quarterly-update-released-yduqrcov2) · Foojay.io · 3 upvotes · 0 comments - [foojay – a place for friends of OpenJDK](https://daily.dev/posts/foojay-a-place-for-friends-of-openjdk-cwvevqwmg) · Foojay.io · 2 upvotes · 0 comments - [Oracle Critical Security Patch Update August 2026](https://daily.dev/posts/oracle-critical-security-patch-update-august-2026-r6ygfhpmb) · Tenable Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java) [View this post on daily.dev](https://daily.dev/posts/azul-august-2026-release-java-s-first-monthly-cspu-mqtul4k9h) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Azul August 2026 Release: Java’s First Monthly CSPU","url":"https://daily.dev/posts/azul-august-2026-release-java-s-first-monthly-cspu-mqtul4k9h","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/azul-august-2026-release-java-s-first-monthly-cspu-mqtul4k9h"},"datePublished":"2026-08-21T07:54:31.328Z","dateModified":"2026-09-14T08:25:13.831Z","description":"Azul shipped the first monthly Critical Security Patch Update (CSPU) in Java's history in August 2026, covering Java 26, 25, 21, 17, 11, 8 (Core/Zulu) and Java...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f4b51aa638255163ec9a9301b6f55c92?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f4b51aa638255163ec9a9301b6f55c92?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Foojay.io","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Foojay.io","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/1820f6a6ae944760aa322b67ed85f848","url":"https://daily.dev/sources/foojayio"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/azul-august-2026-release-java-s-first-monthly-cspu-mqtul4k9h","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,java","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Foojay.io","item":"https://daily.dev/sources/foojayio"},{"@type":"ListItem","position":3,"name":"Azul August 2026 Release: Java’s First Monthly CSPU"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/azul-august-2026-release-java-s-first-monthly-cspu-mqtul4k9h#faq","mainEntity":[{"@type":"Question","name":"What is the difference between a CSPU CPU build and a CSPU PSU build in Azul Java releases?","acceptedAnswer":{"@type":"Answer","text":"A CSPU CPU build contains only critical and security fixes layered on the previous quarterly Critical Patch Update, changing as little as possible so it can move to production fast with minimal retesting. A CSPU PSU build layers on the previous quarterly Patch Set Update and also includes accumulated non-security fixes; it is recommended for testing first, and it is the only line available to free Zulu Community (CA) users. Teams deciding how to roll out JVM patches can track Azul's CPU versus PSU guidance on daily.dev."}},{"@type":"Question","name":"How often does Azul release Critical Security Patch Updates (CSPU) for Java now?","acceptedAnswer":{"@type":"Answer","text":"Azul now issues CSPUs monthly, published on the third Tuesday of any month that does not already have a quarterly release. The August 2026 release was the first monthly CSPU in Java's history, covering Java 26, 25, 21, 17, 11, 8, with backports to 7 and 6 for Core, and Java 25, 21, 17, 11, 8 for the Prime (Zing) line. Developers scheduling JVM upgrades can follow Azul's monthly patch cadence changes on daily.dev."}},{"@type":"Question","name":"Which CVEs did Azul's August 2026 Java CSPU fix?","acceptedAnswer":{"@type":"Answer","text":"The August 2026 CSPU fixed five CVEs, four of which apply to Azul Zulu builds: CVE-2026-61308, CVE-2026-70907, CVE-2026-60589, and CVE-2026-62574, rated one high, two medium, and one low severity. Workloads touching 2D rendering, outbound HTTP, or TLS are flagged as the areas most likely affected by the higher-scoring issues. Teams assessing JVM exposure to new CVEs can check Azul's security patch details on daily.dev."}}]} ```