NLJUG – Nederlandse Java User Group NLJUG – de Nederlandse Java User Group – is opgericht in 2003. De NLJUG verenigt software ontwikkelaars, architecten, ICT managers, studenten, new media developers en haar businesspartners met algemene interesse in alle aspecten van Java Technology.
Author: Frank Delporte
Original post on Foojay: Read More
If someone discloses a critical Java vulnerability the day after a quarterly update, you could wait up to three months for a patched build. That gap is closed now. The August 2026 release is the first monthly Critical Security Patch Update (CSPU) in Java’s history, and Azul shipped it on schedule across both its product lines.
- Core (Zulu Builds of OpenJDK): CSPU builds for Java 26, 25, 21, 17, 11, and 8, with backports to Java 7 and 6. See the Core release notes.
- Prime (Zing Builds of OpenJDK): Azul Zing JVM 26.02.310.0 for Java 25, 21, 17, 11, and 8. See the Prime release notes.
This post explains what a CSPU is and what changes about how you plan patches.
What is a CSPU?
A Critical Security Patch Update is a targeted release that delivers security and stability fixes between the regular quarterly updates. They are published on the third Tuesday of a month that has no quarterly release.
Vulnerability discovery and exploitation keeps accelerating, thanks to AI assistance on both sides. Under the old cadence, a fix could sit for up to three months before reaching you in the next quarterly build. A CSPU can deliver such a fix in the next monthly window instead.
But the scope of a CSPU stays deliberately narrow, as it brings only security and stability fixes. No new features get added or APIs changed, and no behavior is modified beyond the fixes themselves. It also runs through the same build and stability testing Azul and other distributors apply to every quarterly release.
Two build lines: CPU and PSU
Azul splits each CSPU into two separate build lines, and picking the right one matters more now that patches arrive monthly.
- CSPU for CPU builds contain only critical and security fixes on top of the previous quarterly CPU (Critical Patch Update). They change as little as possible, so Azul recommends them for production as the fastest safe path to a patched runtime.
- CSPU for PSU builds build on the previous quarterly PSU (Patch Set Update) and also carry accumulated non-security fixes. Azul recommends them for testing and to be deployed before moving to the next security update. They are also the only line available to free Zulu Community (CA) users.
That split is the practical answer to garantuee stability. As security updates arrive as often as monthly, your window to test and roll out each one shrinks. Security-only CPU builds keep regression risk minimal, so you can move a patch to production quickly without waiting on a full validation cycle for unrelated bug fixes. And after validating the PSU, you can move to the version which also contains other fixes and improvements.
Azul Zulu Build Numbers
| Java | CSPU for CPU (security-only) | CSPU for PSU (security + non-security) |
|---|---|---|
| 26 | n/a | 26.32.203 (CA) / 26.32.204 (SA) |
| 25 | 25.35.204 (SA) | 25.36.205 (CA) / 25.36.206 (SA) |
| 21 | 21.51.204 (SA) | 21.52.203 (CA) / 21.52.204 (SA) |
| 17 | 17.67.204 (SA) | 17.68.203 (CA) / 17.68.204 (SA) |
| 11 | 11.89.204 (SA) | 11.90.205 (CA) / 11.90.206 (SA) |
| 8 | 8.95.0.204 (SA) | 8.96.0.205 (CA) / 8.96.0.206 (SA) |
| 7 | 7.87.0.204 (SA) | n/a |
| 6 | 6.81.0.204 (SA) | n/a |
CA marks the Community, free-to-use builds. SA marks the Subscription builds.
Security fixes
This CSPU fixes five CVEs of which four apply to Azul Zulu builds: one high-severity, two medium, and one low.
| CVE | Component | Base score | Severity |
|---|---|---|---|
| CVE-2026-70906 | 2D | 7.5 | High |
| CVE-2026-61308 | Networking / HTTP | 6.8 | Medium |
| CVE-2026-70907 | JSSE / TLS | 5.3 | Medium |
| CVE-2026-60589 | Security | 3.7 | Low |
| CVE-2026-62574 | Install | 7.8 | High |
What this changes for you
- Check exposure. If your workloads touch 2D rendering, outbound HTTP, or TLS, treat the three higher-scoring CVEs as relevant and prioritize accordingly.
- Default to CPU for production. The security-only line gives you the patch with the least change, so you reach production faster and with less to re-test.
- Adjust your automation, not your calendar. Quarterly updates keep their usual dates. CSPUs land on the third Tuesday of the months in between. Azul schedules them monthly but releases them as and when a fix warrants one, so build your pipeline to pick up new builds rather than waiting for a fixed date. As an example, Oracle and Azul have not yet confirmed a CSPU for September 2026.
Azul also runs monthly Java security briefings walking through the CVEs in each update, now aligned with the CSPU cadence.
Where to get it
Full details, checksums, and the complete list of fixes live in the Core release notes and Prime release notes. The Azul downloads page hosts builds for every supported version and platform. For the background on why Azul moved to monthly patches, read Azul Will Deliver Monthly Java CSPUs, Increasing Patch Velocity with Stability.
Monthly patching only helps if you act on it. A security-only build that reaches production in days instead of months is the whole point.
The post Azul August 2026 Release: Java’s First Monthly CSPU appeared first on foojay.