[Looking for Charlie's main web site? or all posts?]

Announcing Java updates of Oct 20 2026 - thoughts and resources

Posted At : October 20, 2026 9:41 PM | Posted By : Charlie Arehart
Related Categories: java
Comments: (0)
It's that time again: there are new Oracle JVM updates released today (Oct 20, 2026) for the current long-term support (LTS) releases of Oracle Java 25, 21, 17, 11, and 8, as well as the newest short-term release, 27. (Yep, there are for now 5 current Oracle Java "LTS" releases, for historical reasons.)

TLDR: The new updates are 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, and 1.8.0_511 (aka 8u511) respectively. From a compatibility perspective, the update seems a pretty modest one, without seeming breaking changes (though my opinion is based solely on my read of the update release notes, on this first day).

More on the updates below, including links to more info on each of them including what changed, bug fixes, and the security fixes each version contains. FWIW, openjdk updates are usually released at the same time or soon after, so the info should also help users of such alternative JDK implementations.

I also have new sections below on Oracle's move to (potentially) monthly Java security updates as well as how to register for free email notification of Oracle updates.

For some folks, the above is all they need to hear. For others, whether this your first time updating Java or your fiftieth, there are some things that you may or may not know, as I cover here.

Topics:

Note also that Oracle while calls these updates "critical patch updates" (yep, "CPU"), they are in fact scheduled quarterly updates (Jan, Apr, Jul, Oct, with specific dates listed here), so that the "critical" aspect of this nomenclature may sometimes be a bit overstated. Even so, each does also address security matters (CVEs). See more below on the specific security changes. And as is generally the case with these Java updates, most of them have the same changes and fixes across the current LTS JVM versions.

As I note in the topics above, note as well a recent change where Oracle is going to MONTHLY security updates for Java. See below for more on that.

Finding more info on these most recent Java updates

As for what changed in the updates, see the release notes for each of: (Again, Java 27 is a "short-term" release while the others are what Oracle calls "long-term support" or LTS releases.)

These Oracle release notes typically have sections on topics such as "New Features", "Known Issues", "Issues Fixed", "Other notes", and "Fixes"--each as may apply to that specific update, though some changes may (and often do) apply to all or multiple versions, especially the LTS ones.

For the details of what's new or changed (or fixed), see the release note for whichever update you are considering applying, as I don't want to repeat the details there, especially in terms of new or changed features, bug fixes, security holes closed, etc. The technotes detail that information.

Changes, in brief, especially from a compatibility perspective

But since I'm focused on helping people who may be wanting to apply the updates more just to "stay updated", here is at least a brief assessment of the changes I observed the release notes, from the perspective of compatibility issues, as I've compared them across all of the LTS versions that were updated:

This JVM update seems pretty innocuous, across all the versions, as far as compatibility is concerned. That said, you should consider the release notes for yourself, in case something there may seem important to you.

Also, those using Java 21 will want to note an important licensing change, where (as had happened previously for Java 17 and earlier releases) use is now covered by the OTN rather than NFTC license. As the release note summarizes, "The OTN for Java SE license permits certain uses, such as personal use and development use, at no cost, but other uses authorized under the NFTC may no longer be available." See links to more detail in that Java 21.0.13 release note. I'll discuss how this change impacts obtaining this version from Oracle's public web site.

What if you're skipping over other recent JVM updates?

While sometimes there may not be (or may be) much significant to any one Java version's update (or nothing may seem to apply to you), note that if you may be skipping OVER recent Java updates to get to this one, then you DO need to consider also what was changed in THOSE updates.

You can find the list of the release notes for all the updates for each of Java versions 25, 21, 17, 11, and 8. And FWIW I have typically offered a blog post like this on updates in recent years. See my java category of posts.

Finding more on security matters addressed in these Java updates

As for security fixes included in this update, those are covered for each release by still other Oracle documents.

First, see the single document listing Java security fixes in this most recent update. That should take you to a section labelled "Oracle Java SE Risk Matrix"

Second, see the Text Form of Risk Matrix for Oracle Java SE.

As for that first link, pay close attention to "notes" column offered there on the right for each vulnerability, as that may temper the severity. (Note as well that while both these documents cover ALL Oracle products, I have offered above links to the Java-specific sections of the pages. Focus on references to "Java SE" rather than any specific to GraalVM, which is not the focus of the discussion in this post.)

Watch also that many times the listed issues indicate that a vulnerability may be "difficult to exploit" and that many "[do] not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator", which may reduce the concern for you about them depending on your perspective.

While I point you to them, it's your responsibility to assess that information carefully. And regardless of whether such vulnerabilities may seem to apply to you, generally folks should seek to keep their JVM updated, or at least avoid falling too far behind.

Oracle's move to monthly security updates (CSPU), which MAY mean Java updates other than quarterly

Some may not yet have heard that recently Oracle changed their update policy regarding SECURITY updates, where now they commit to follolwing instead a MONTHLY cadence of updates addressing security issues specifically. That said, it doesn't mean that every Oracle product will GET such a monthly upddate.

I've not previously tracked those. The first and only one so far for Java was in Aug 2026 (25.0.4.1, 21.0.12.1, 17.0.20.1, and so on). It had its own versions of those bulletins linked to in the previous section. And it was offered on the same download pages I linked to above, though once this new CPU update has come out it's no longer offered there.

I'm torn as to whether to start posting about each such CPSU update. I may, since they are relatively random.

As for anticipating them, Oracle schedules such CSPU updates (potentially released, across all products) to fall on the third Tuesday of each month--not including the month of the release of a CPU update, like this one. So the next such Java CSPU update could be on Nov 17, 2026, or Dec 15, 2026, or Feb 16 2027 (skipping Jan, when the next CPU update would come out), and so on. You can also see the current "next dates" in both the first security fix list in the previous section as well as a section in the Oracle page on Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins. But again, it's not a given that there would be a CSPU update *for java* on each of those dates.

Getting notified about Oracle JVM updates

While we're on the topic of knowing when updates of either type may be released, I should point out that you can arrange to get free email notification from Oracle about both kinds of updates (as mentioned and linked to in that previous resource I shared). See the Instructions for subscribing to email notifications of Critical Patch Updates, Critical Security Patch Updates and Security Alerts (which requires having an Oracle account, which again is free). Sadly, the email sent announces updates to any Oracle products: you can't choose to be notified only about updates to Oracle Java products. (One could opt instead to keep an eye out for community discussions of openJDK updates--and some openjdk vendors may offer their own specific notification feature.)

Obtaining the JVM update, from Oracle

As for obtaining downloads of Java updates, you can find all the current versions on this one page. Note that recent Java versions are offered in tabs at the top of the page, while the older LTS versions are offered in tabs further down the page, as I indicate below.

Note that there are also then tabs for the installers of a given update as provided for each supported OS (Linux, macOS, and Windows), and then also both installer binaries and "compressed archives"/zip/tar.gz files.

(Also, to users of Adobe ColdFusion--my primary audience--note that Adobe provides their own downloads page for Oracle Java installer binaries and zips. More on that below, after this next section.)

Oracle downloads for Java 26, 25, and 21

The top of that Oracle downloads page offers the LATEST Java versions, 27 and 25 (the older ones are further down that page):

Note that those updates for Java 25 and above do NOT require a login on the Oracle site, as they are offered under Oracle's NFTC license (explained there). Note that Java 25 will get updates until Sep 2028, a year after the next LTS is expected to be released.

Oracle downloads for Java 21, 17, 11, and 8

As for the remaining versions and their downloads, they are offered further down that Oracle downloads page (or via links I offer next). Note that to download those files you WILL be prompted for an Oracle sign in, as they are offered under a different license (OTN, also discussed there), but note that an Oracle account is available for free if you don't yet have one.

Here are direct links to the section at the bottom for that downloads page for the remaining Java versions:

Obtaining the JVM update, from Adobe

As my blog and work is mostly focused on those using Adobe ColdFusion (as well as Lucee and BoxLang, and all 3 run atop Java), I'll clarify especially for CF users that Adobe offers the Oracle Java downloads, such that one need not log into the Oracle site as discussed in the previous section.

See the CF Downloads page, and its last section offering Java installers ("Java versions supported in ColdFusion"), which includes the installers or zip/archive options, for each of Windows, Linux, and MacOS. FWIW, it offers installers for each of the Java versions supported by each CF product, such as Java 21 for use with CF2025, Java 17 for use with CF2023, Java 11 for use with CF2021 and earlier, and Java 8 for use with the CF API Manager.

As of my posting this today, the Adobe downloads page for CF-related installers does not yet have the downloads for this latest update. Sometime that can take even days. Watch that space for changes over time, or use the Oracle downloads approach I offer above.

Note that until May of 2026, that page had a drop-down you had to use to see its different sections, including one for "java installers". For now, again just scroll down/find the section, "Java versions supported in ColdFusion".

Note also that Adobe tends to offer the 3 most recent updates for the Java versions that are supported for each current CF version (so the 3 most recent Java 21 updates for use with CF2025, the 3 most recent Java 17 updates for use with CF2023, and older java for older software whose downloads they may still offer on that page.) Sometimes they fail to remove older ones, so you may find more than 3 per Java version.

Finally, you may well find the "latest" Java version installers (the current latest update they offer, for each of Java 21, 17, 11, and 8) grouped all together above the other older installers, as I found for the first time with the July 2026 Java updates. For years before, the latest of each was offered above the other older versions of each (all the java 21 versions, with its latest at the top, then all the java 17 versions with its latest version at the top, and so on.) I don't like the vagaries, but I'm just a guide here.

Three technicalities to be aware of, about use of Oracle Java with ColdFusion

While I am speaking to the CF audience here, let me offer 3 points to consider about Oracle licensing matters.

  • As for choosing between these two options of where to obtain these downloads (and given how there can sometimes be a delay in the latest appearing at Adobe), some people assert that CF folks "must use those from the CF downloads page" and not the Oracle one. But I'll note that every time I've done a binary compare of the installers files (of some given version and OS, on the day it came out and Adobe offered it), the ones Adobe offers have been identical to those offered on the Oracle site (at least for the identical build number, which may change slightly over time on the Oracle site though not the Adobe site). As this installer includes the Java license, I can't see how anyone could assert that it matters WHERE you get an identical installer. But IANAL. The choice is yours, if you want the update ASAP and Adobe doesn't offer it yet.
  • While some may be tempted to go get some other JVM/JDK, like an openjdk, note that Adobe has always formally supported only the use of Oracle Java with CF, not other OpenJDK implementations. I'm not saying it WON'T work. But be aware of this point--and please consider pointing out when you may be using some non-Oracle JVM when reporting issue with CF.
  • Finally, note also that Adobe licenses Oracle Java for our use of it with CF--but CF only. More on that in the resource discussed next. This applies whether the version is offered by Oracle under its OTN or NFTC license--though again only for your use of Java with CF.

Other topics you may be interested to know, and where I discuss them

Some readers may find the above so far to have been "a lot to consider" already, but there is indeed far more that you could and should consider before applying a Java update. And for a few years, I would cover such additional topics within this sort of blog post, each time I announced the new JVM update. But I've decided recently to split that off into its own blog entry, and I will point to that instead in each of these such JVM update announcement posts, in order to keep this relatively "brief". (I've kept some of the other points above because they affect OBTAINING the download.)

In that other post, I address such issues as:

  • Obtaining and learning still more about available JVM updates
  • What about other JVM distributions besides Oracle?
  • News for my CF audience: Oracle licensing, obtaining updates from Adobe, and more
  • Should you apply the update? how soon?

Then I cover a few things that you should be aware of if skipping over previous JVM updates (Sometimes people are literally a couple to a few years behind):

Again, that other post of mine with more info is here: Several things to consider when applying JVM updates.

Wrapping up, getting more help

I hope all that may be helpful for you.

Feel free to ask questions or raise comments below, or for direct help note that I offer remote screenshare consulting help, where I am usually able to quickly fix problems (that might take me only minutes to resolve, but might take many folks hours on their own--if they don't deal with these issues daily like I do in helping people).

For more content like this from Charlie Arehart: Need more help with problems?
  • If you may prefer direct help, rather than digging around here/elsewhere or via comments, he can help via his online consulting services
  • See that page for more on how he can help a) over the web, safely and securely, b) usually very quickly, c) teaching you along the way, and d) with satisfaction guaranteed
Comments (0)
Comments

There are no comments for this entry.

[Add Comment]
Copyright ©2026 Charlie Arehart
Carehart Logo
BlogCFC was created by Raymond Camden. This blog is running version 5.005.
(Want to validate the HTML in this page?)

Managed Hosting Services provided by
xByte cloud Hosting