Java Critical Patch Update July 2026: New Versions and How to Update Safely

Latest Updates

Last checked: July 29, 2026.

• July 21, 2026 – Oracle released its July 2026 Critical Patch Update (CPU), the third quarterly security release of the year. It addresses 1,235 CVEs across 32 product families, including Java SE, with 261 of those fixes rated critical.
• The updated Java SE versions are: 26.0.2, 25.0.4, 21.0.12, 17.0.20, 11.0.32, and 8u501.
• Oracle says roughly 600 of this quarter’s fixes across its product line can be exploited remotely by an unauthenticated attacker, which is why security teams treat CPU releases as high priority.

We’ll update this section whenever Oracle ships its next quarterly Critical Patch Update (Oracle releases these on a fixed quarterly schedule, typically in January, April, July, and October).

What Is Oracle’s Critical Patch Update?

The Critical Patch Update is Oracle’s quarterly, scheduled security release covering nearly all of its products, including Java SE. Rather than patching issues one at a time, Oracle bundles fixes into these quarterly releases so IT teams and home users can plan updates around a predictable schedule instead of reacting to one-off advisories.

For Java specifically, each CPU brings a new “update” version for every actively supported release line – which is why you’ll see several version numbers listed above instead of just one. If you have Java 8, 11, 17, 21, or 26 installed, there’s a matching security update for your version.

Why You Should Update Java Now

Java errors and slowdowns – the kind we cover often on this site – are frequently tied to running an outdated Java version. Beyond stability, an unpatched Java installation is a real security risk: this quarter alone, Oracle fixed hundreds of vulnerabilities that could be exploited without any authentication, meaning an attacker wouldn’t need a password or user interaction to take advantage of them on an unpatched system.

If you use Java for browser applets, desktop applications, or business software, staying on the latest update within your version line closes these gaps without requiring you to move to a completely new major version.

How to Check Your Current Java Version

1. Open Command Prompt (Windows) or Terminal (Mac).
2. Type java -version and press Enter.
3. Compare the version number shown to the latest versions listed in the Latest Updates section above.

How to Update Java Safely

1. Go to the official Java download page at java.com/en/download (for personal use) or oracle.com/java (for all supported versions, including 8, 11, 17, 21, and 26).
2. Download the installer that matches your operating system and the Java version you currently use.
3. Close any running Java applications before installing.
4. Run the installer and follow the prompts – on Windows, older versions are typically replaced automatically during update-in-place installs.
5. Restart your computer, then confirm the update worked by running java -version again.

A Note on Old, Unsupported Java Versions

If java -version shows a version far older than the ones listed above (for example, anything before 8u501), you’re likely on a release Oracle no longer patches. In that case, a full reinstall from the official download page – rather than an in-place update – is the safer route, since older installers may not detect the newer release as an eligible update path.

Conclusion

Oracle’s July 2026 Critical Patch Update is one of the larger quarterly releases in recent memory, and the Java SE fixes included in it are worth installing promptly given how many of the underlying vulnerabilities don’t require an attacker to have prior access. Check your version, grab the matching update from Oracle’s official site, and keep an eye on the Latest Updates section above for the next quarterly release.

FAQ