Oracle releases Critical Patch Updates (CPUs) on the third Tuesday of January, April, July and October. A newer Critical Security Patch Update (CSPU) cycle fills the other months, and Security Alerts cover anything too urgent to wait. Dates below come from Oracle's security alerts page as fetched on 19 October 2026.
The three kinds of release
| Release | Cadence | What it is |
|---|---|---|
| Critical Patch Update | Third Tuesday of Jan, Apr, Jul, Oct | A collection of patches for many vulnerabilities, usually cumulative |
| Critical Security Patch Update | Third Tuesday of Feb, Mar, May, Jun, Aug, Sep, Nov, Dec | Targeted, high priority fixes in a smaller format |
| Security Alert | As needed | Fixes too critical to wait for the next update |
Oracle states that CPUs address flaws in Oracle code and in third party components shipped in its products, and that the patches are available to customers with valid support contracts. Oracle also says the first CSPU was released on 28 May 2026, so this cycle is new. Check that your runbooks do not assume a purely quarterly rhythm any more.
Upcoming dates
| Release | Date |
|---|---|
| October 2026 CPU | 20 October 2026 |
| November 2026 CSPU | 17 November 2026 |
| December 2026 CSPU | 15 December 2026 |
| January 2027 CPU | 19 January 2027 |
Oracle publishes a pre-release announcement on the Thursday before each CPU, and for CSPUs beginning June 2026. That gives you a few days to line up people and test environments.
Revisions after release
Look at the revision numbers in Oracle's table. The July 2026 CPU shows Rev 7, dated 20 August 2026, and the August 2026 CSPU shows Rev 4, dated 4 September 2026. An advisory is a living document. If your team reads it once on release day and files it, you may miss added information.
A practical habit: store the revision you acted on in the ticket, and recheck the page a week later.
A planning checklist
- Put every date above in a shared calendar, with the Thursday pre-release as a reminder.
- Confirm your support contract status for each Oracle product. Without it, you cannot download the patches.
- Map products to owners before release day.
- On release day, read the advisory risk matrices for the products you run and skip the rest.
- Pilot in a test environment that mirrors production, then roll out in rings.
- Record the revision and the patch level reached.
- Recheck the advisory page the following week for revisions.
If Oracle software sits underneath your applications, ask your platform team which products and versions you actually run. An accurate inventory is what makes steps 3 and 4 quick.
Try it yourself
Click through it at your own pace, or open it full screen.
Look for how findings change over time, because an advisory revision should show up as a change you notice, not one you stumble on.
Safeguard does continuous SBOM and dependency scanning plus compliance evidence automation, and you can start with a free scan.
Quick check
Are Oracle Critical Patch Updates monthly?
No. According to Oracle, CPUs are released on the third Tuesday of January, April, July and October. The newer CSPU cycle covers other months.
Do I need a support contract to get these patches?
Oracle's page says the patches are available to customers with valid support contracts.
Sources
Last reviewed: 19 October 2026.
