Oracle's August 2026 Critical Patch Update Lands as JDK 27 Nears Release
A large monthly security batch across every supported Java SE line arrives alongside an early look at what JDK 27 is shipping in September.
Oracle published its August 2026 Critical Patch Update (CPU) on August 18, 2026, part of a coordinated quarterly-plus-monthly security release cycle that spans Oracle's entire product line, Java SE included. Oracle's own tracking puts this particular cycle at 943 total security patches across all product families — among the larger monthly batches of the year, though only a subset applies to Java SE specifically.
The updated Oracle Java SE builds from this cycle are 26.0.2.1, 25.0.4.1, 21.0.12.1, 17.0.20.1, 11.0.32.1, and 8u503, covering every actively supported line back to Java 8. Oracle indexes the specific CVEs fixed in each build under its Critical Security Patch Update advisory.
The OpenJDK ecosystem beyond Oracle moved in step: BellSoft shipped matching Liberica JDK builds, and Microsoft's own Build of OpenJDK followed within the week with updates to its 25, 21, 17, and 11 lines. That kind of lockstep, multi-vendor patching is now the norm for OpenJDK — teams running a non-Oracle distribution shouldn't assume they're waiting longer for the same fixes.
Meanwhile, JDK 27 is moving toward its own release, targeted for general availability on September 15, 2026. The early JEP list gives a preview of what's landing: JEP 523 makes G1 the default garbage collector in all environments, JEP 534 makes compact object headers the default (reducing per-object memory overhead), and JEP 527 adds post-quantum hybrid key exchange to TLS 1.3.
Several other features are advancing through repeated preview cycles rather than finalizing outright — Lazy Constants reaches a third preview, Primitive Types in Patterns a fifth, and Structured Concurrency a seventh — consistent with how the JDK's preview-feature process is designed to work: real-world feedback across multiple six-month cycles before a feature locks in as permanent. JEP 537 also pushes the Vector API to its twelfth incubator round.
Both the CPU advisory and the JDK 27 project page are maintained directly by Oracle and the OpenJDK project respectively, and are the canonical references for teams tracking exact CVE and JEP details ahead of the September release.
Source: Oracle — Critical Security Patch Update Advisory, August 2026