Oracle is shifting from quarterly to monthly security patch releases starting May 28, 2026. The new Critical Security Patch Updates (CSPUs) will drop on the third Tuesday of each month — one week after Microsoft, SAP, and Adobe, which all patch on the second Tuesday.
The driver is straightforward: AI tools are finding vulnerabilities faster than a quarterly cadence can address them. Oracle is using both OpenAI and Anthropic’s Claude Mythos Preview to identify and fix vulnerabilities more quickly on its end as well.
Quarterly cumulative Critical Patch Updates will continue alongside the new monthly releases, so the existing schedule isn’t going away — it’s just getting supplemented.
For customers, the practical impact depends on how Oracle manages their environment. Oracle-managed cloud customers get automatic updates. Everyone else — on-premises deployments and third-party hosted setups — will need to apply patches manually, which means more frequent maintenance windows starting next year.

Collections

Oracle is transitioning from quarterly to monthly security patch releases starting May 28, 2026. The new Critical Security Patch Updates (CSPUs) will land on the third Tuesday of each month. The shift is driven by AI tools — including OpenAI and Anthropic's Claude Mythos Preview — accelerating vulnerability discovery faster than a quarterly cadence can handle. Quarterly cumulative patches will continue alongside the new monthly releases. Oracle-managed cloud customers receive automatic updates, while on-premises and third-party hosted deployments will require manual patching, meaning more frequent maintenance windows.

Oracle moves to monthly security patches, citing AI-accelerated vulnerability discovery