New Between-Quarters Security Updates for Java: What CSPUs Mean for Your Release Pipeline

Oracle is introducing Critical Security Patch Updates (CSPUs) for Java, delivering security fixes between the existing quarterly CPU releases. The first Java CSPU ships August 18, 2026 as JDK 26.0.2.1. CSPUs carry only security and stability fixes — no new features or API changes — and follow the same versioning convention as quarterly updates. The change is driven by AI accelerating vulnerability exploitation timelines, making the 90-day quarterly window too long. Teams need to update patch-monitoring to a monthly cadence, ensure their CI/CD pipelines can handle irregular security releases, and check how their JDK vendor plans to handle CSPUs. Azul has already confirmed support for monthly CSPU delivery.