Java Critical Patch Update August 2026: New Versions and Why Oracle Now Patches Twice as Often

Oracle shipped its August 2026 Critical Security Patch Update (CSPU) on August 18, 2026, bringing Java SE to versions 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 26.0.2.1. If you’re used to Java security updates arriving once a quarter, this one is worth a closer look — because starting this year, Oracle isn’t just doing quarterly patches for Java anymore.

Oracle Now Patches Twice as Often

For years, Oracle’s Critical Patch Update (CPU) shipped on a fixed quarterly schedule — January, April, July, October. That’s still true; October 20, 2026 is the next full quarterly CPU. But Oracle has added a second, smaller release type: the Critical Security Patch Update, which now ships on the third Tuesday of the in-between months. This August release was a CSPU, not a CPU, and the next ones are scheduled for September 15, November 17, and December 15, 2026. Oracle describes CSPUs as “targeted, high-priority security fixes in a smaller, more focused format” that complement, rather than replace, the quarterly cumulative CPUs. In practice, that means Java (and every other Oracle product on the list) can now get meaningful security fixes in eight months of the year instead of four — which is a real change from the July 2026 CPU we covered previously, and worth knowing if you only check for Java updates once a quarter out of habit.

This August’s CSPU was a large one: 943 new security patches covering 23 Oracle product families, including Java SE, GraalVM for JDK, and GraalVM Enterprise Edition. That’s on top of, not instead of, the 1,235 CVEs Oracle addressed across 32 product families in July’s quarterly CPU.

What Changed for Java Specifically

The affected Java SE versions going into this update were 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, and 26.0.2 — each of those gets bumped to its next patch release (8u503, 11.0.32.1, and so on) to close out the vulnerabilities addressed this round. GraalVM for JDK (versions 17.0.20 and 21.0.12) and GraalVM Enterprise Edition 21.3.19 were also covered. If you’re on the Microsoft Build of OpenJDK instead of Oracle’s own distribution, Microsoft shipped its equivalent August critical patch release separately on August 24, with matching version bumps for OpenJDK 25, 21, 17, and 11 and source available on GitHub. Azul, another popular OpenJDK vendor, used this same window to roll out its first monthly Zulu security update release — a sign that faster Java patch cadences aren’t just an Oracle thing right now; the whole ecosystem is moving that direction.

How to Check Your Version and Update

1. Open Command Prompt (Windows) or Terminal (Mac) and run java -version.
2. Compare what you see against the patched versions above — if your version number is lower, you’re due for an update.
3. Grab the matching installer from java.com/en/download for personal use, or oracle.com/java if you need a specific supported version line like 8, 11, 17, 21, or 26.
4. Close any running Java applications, run the installer, and restart your computer once it finishes.
5. Run java -version again to confirm the update actually took.

If you’re on a distribution other than Oracle’s — Microsoft’s Build of OpenJDK or Azul’s Zulu builds, for example — the version-check step is the same, but you’ll need to download from that vendor’s own release page rather than Oracle’s, since the build artifacts aren’t interchangeable even when the underlying version numbers line up.

Why the Faster Cadence Actually Matters

It’s tempting to assume a “smaller, more focused” CSPU is lower priority than a full quarterly CPU, but that’s not really the right way to think about it. A CSPU exists specifically to get high-priority fixes out faster than waiting for the next quarterly cycle would allow — skipping one because it feels like a minor release defeats the purpose. If you or your organization only checks for Java updates around the old quarterly schedule, you’re now missing roughly half of the patch windows Oracle actually ships. For background on what the last quarterly CPU covered, or if you’re dealing with install errors rather than routine patching, see our guide to fixing Java error code 1618, which is often triggered by an interrupted or conflicting update.

FAQ