For twelve years, Java security updates have run on the same predictable schedule: a Critical Patch Update (CPU) every quarter, released on the third Tuesday of January, April, July and October. That’s likely to continue for the foreseeable future, with the addition that Azul will deliver monthly Critical Security Patch Updates (CSPUs), which are high-priority fixes that can land between quarterly cycles. If your team manages Java in production, CSPUs will affect your patch pipeline starting in August.
What exactly is a CSPU, and how is it different from a CPU?
A CSPU isn’t a new kind of release you need a separate process for. It’s the same type of update you already apply every quarter, but delivered on an as-needed monthly schedule instead of waiting a full 90 days. CSPUs only carry security and stability fixes. So, no new features or API changes. There are no behavior changes outside of the vulnerability fixes themselves. The first Java CSPU lands August 18, 2026. A CSPU release for JDK 26 (versioned 26.0.2.1) is confirmed. This also applies to the 8u, 11u, 17u, 21u and 25u versions and will treat CSPUs the way they already treat interim releases: branch from the last GA tag, apply the fixes, keep scope minimal, and merge back. The regular quarterly cycle keeps running underneath and is unaffected.
- Quarterly CPUs continue unchanged: January, April, July, October, released on the third Tuesday.
- CSPUs slot in between quarters when one or more vulnerabilities are too urgent to wait. But note that CSPUs are not guaranteed every month.
Why is this happening now?
AI has sped up both sides of the vulnerability lifecycle. Attackers can search for exploitable weaknesses faster than before, and defenders can find and fix them faster too. A 90-day wait for the next CPU, once an acceptable window, now leaves more time for agentic AI to weaponize a known vulnerability before a fix gets shipped. While out-of-cycle updates provided quick fixes in the past, they were unscheduled. CSPUs provide a more reliable way to help close the gap without waiting for a full quarterly release. Oracle first signaled this shift on April 26, 2026, announcing faster Vulnerability Detection and Response across its product line. The Java-specific details, including the August 18 date, followed via the OpenJDK Updates mailing list.
What should you look for in a Java update security process?
As patch frequency increases, the scope of discipline matters more. The safest updates are the ones scoped specifically to vulnerability fixes, with no unrelated changes bundled in that could introduce regressions. Enterprises should expect the same rigorous stability validation on every release, whether it’s a quarterly CPU or a CSPU, so a faster calendar doesn’t mean a bigger testing burden internally. That’s exactly what Azul offers!
Azul is ready for a monthly Java security cadence!
Azul’s release infrastructure and validation processes for Azul Core (which includes Zulu Builds of OpenJDK) and Azul Prime (which includes Zing Builds of OpenJDK) are already built for this. Azul supports a faster cadence across every version we ship, including LTS releases like 8, 11, 17, 21, and 25, as well as the current release, Java 26, and end-of-life versions such as 6 and 7 that no one else provides security updates for anymore. Every release goes through the same rigorous stability testing that Azul runs on today’s quarterly updates. These are provided under the same SLA, so a faster calendar doesn’t add operational burden or expand your testing cycles.
“For years, the world’s most demanding enterprises have trusted Azul to deliver security and stability together, and on time,” said Scott Sellers, co-founder and CEO of Azul. “As AI sharply increases the volume of threats enterprises face, enterprises shouldn’t have to choose between the two. Monthly security-only updates are the new standard Azul is setting for how enterprises protect their Java estates.”
Azul’s release infrastructure supports the new cadence without added operational risk. That coverage extends across every supported version, including EOL releases.
What should your team do?
Treat every CSPU-equivalent release exactly like today’s quarterly CPU. Pull it into dependency management, run your existing test suite, and promote it through your normal pipeline. The only real change is frequency. Checks now need to happen on an as-needed, scheduled monthly rhythm, in addition to every three months for the quarterly update. Update your patch-monitoring process to be able to check monthly, whether there’s a CSPU available or not, and confirm your pipeline can run on a monthly trigger without manual bottlenecks.
Read more:
- https://www.azul.com/blog/get-your-java-estate-ready-for-the-growing-agentic-ai-threat/
- History of CVE history fixes in Azul Core
- Azul to Deliver Monthly Critical Security Patch Updates for Java Across All Supported LTS Versions – Azul | Better Java Performance, Superior Java Support
