Oracle intends to provide Java security updates more frequently than the current quarterly CPU cadence of January, April, July, and October. Oracle is targeting a monthly update for August 18, 2026, in addition to the regularly scheduled July and October CPU releases. We plan to provide multiple monthly updates in CY27; organizations should be preparing for this cadence.

Inside Java is a resource for Java developers, offering insights, tutorials, and updates on the Java programming language, platform, and ecosystem. With contributions from Java experts and members of the Java community, Inside Java covers a wide range of topics, including language features, performance optimizations, and upcoming releases. Developers can stay informed about the latest developments in the Java ecosystem, learn about new APIs and frameworks, and explore best practices for building robust and scalable Java applications.

Inside Java

Oracle is shifting Java security updates from a quarterly to a monthly cadence. Starting August 18, 2026, Java will receive Critical Security Patch Updates (CSPUs) monthly, in addition to the existing quarterly CPU releases in July and October. The change is driven by AI-accelerated vulnerability discovery and remediation. Multiple monthly updates are planned for 2027, and organizations bundling JDK/JRE with applications should begin preparing their build, test, and deployment pipelines for this faster update frequency.

Transitioning Java to more frequent security updates