Oracle Shifts to Monthly Security Patch Updates to Accelerate Remediation
Oracle has introduced a new monthly Critical Security Patch Update (CSPU) cycle to help customers address vulnerabilities more quickly while maintaining its existing quarterly patch schedule.
Starting in May 2026, Oracle has transitioned to a new delivery model for its security fixes, introducing monthly Critical Security Patch Updates (CSPUs) alongside its existing quarterly schedule. This shift is designed to provide smaller, more focused updates, allowing organizations to address critical vulnerabilities more rapidly in customer-managed environments Help Net Security.
While Oracle-managed services will continue to receive automatic and continuous updates, the new CSPU model specifically targets customers managing their own deployments, whether on-premises or within Oracle Cloud Infrastructure. Under this framework, Oracle remains responsible for identifying vulnerabilities and releasing the necessary patches, but the burden of planning, testing, and applying these updates remains with the customer Help Net Security.
The company emphasized that the quarterly Critical Patch Updates (CPUs) will remain in effect. These quarterly releases will serve as a cumulative repository, incorporating all fixes previously issued through the monthly CSPU cycle. This dual-track approach is intended to balance the need for urgent, targeted remediation with the stability provided by comprehensive quarterly rollups Help Net Security.
To support this increased cadence, Oracle is leveraging advanced artificial intelligence to accelerate both vulnerability discovery and remediation. By utilizing access to sophisticated models, including Anthropic’s Claude Mythos Preview and OpenAI’s latest capabilities via Trusted Access for Cyber, Oracle aims to scale its security operations. These AI-driven enhancements are being applied across Oracle-developed software, Oracle Health, and the various open-source components integrated into their products Help Net Security.
Oracle maintains that keeping systems current is a primary method for risk reduction. Recognizing that patching can be a complex undertaking in large, highly integrated environments, the company is directing customers to utilize resources such as My Oracle Support, Technical Account Management, and Customer Success teams to facilitate the testing and execution of these more frequent updates Help Net Security.
This shift reflects a broader industry trend toward faster vulnerability disclosure and remediation cycles, driven by the increasing speed at which new security flaws are identified. By moving to a monthly cadence, Oracle is aligning its patch management strategy with the realities of modern threat landscapes, where the window between vulnerability discovery and exploitation continues to shrink. Organizations should prepare for a more frequent maintenance schedule to ensure their environments remain protected against emerging threats.