Oracle Accelerates Patch Cycles to Monthly: Countering AI-Enabled Threat Discovery

Oracle Shifts from Quarterly to Monthly Security Patches

In response to the accelerating pace of AI-driven vulnerability detection, Oracle has announced it will move from a quarterly to a monthly security patch schedule for its enterprise resource planning (ERP), database, and other software products. The change reflects a broader industry trend where vendors are tightening update cycles to keep ahead of artificial intelligence tools that can uncover software flaws faster than ever before.

Other major software vendors, including Microsoft, SAP, and Adobe, have long released patches on a monthly basis—traditionally on the second Tuesday of each month, commonly known as Patch Tuesday. Oracle, however, is taking a slightly different path. The company will release its first monthly Critical Security Patch Update (CSPU) on May 28, a Thursday, and thereafter schedule its updates for the third Tuesday of every month—one week after the industry’s typical Patch Tuesday. The initial batches are slated for June 16, July 21, and August 18, as confirmed by Oracle earlier this week.

What the New Schedule Means

According to Oracle, the new monthly CSPUs are designed to “provide targeted fixes for critical vulnerabilities in a smaller, more focused format, allowing customers to address high-priority issues without waiting for the next quarterly release.” In addition, the company will continue to issue a cumulative Critical Patch Update (CPU) each quarter, maintaining the previous quarterly rhythm for non-urgent fixes. The first quarterly update of 2025 was released in January.

This dual approach—monthly fixes for critical flaws and quarterly comprehensive updates—gives customers flexibility. Those who need rapid mitigation for high-severity vulnerabilities can apply the monthly CSPU, while others may prefer to bundle fixes with the quarterly CPU.

Impact on On-Premises vs. Cloud Customers

The new patching rhythm will primarily affect organizations running Oracle applications on on-premises infrastructure or in third-party hosting environments. For these customers, applying patches manually or via their own update management tools becomes more frequent. In contrast, customers using Oracle software in an Oracle-managed cloud will not need to take any action—Oracle applies the patches automatically.

This distinction highlights a key benefit of cloud migration: reduced operational overhead for security maintenance. However, for enterprises with hybrid deployments or strict change-control policies, the monthly cadence may require adjustments to testing and deployment workflows.

AI’s Role in Faster Vulnerability Discovery and Patching

Oracle is leveraging artificial intelligence to both identify and remediate vulnerabilities more swiftly. The company has gained access to OpenAI’s latest models through its Trusted Access for Cyber program, as well as to Anthropic’s Claude Mythos Preview. These AI tools help Oracle analyze codebases, simulate attack vectors, and prioritize patches.

The use of Mythos has contributed to growing concerns that AI could uncover thousands of zero-day vulnerabilities in software products, potentially overwhelming vendor response capabilities. As of mid-April, however, only one vulnerability report had been directly attributed to Mythos, suggesting that the anticipated AI-driven flood of zero-days has not yet materialized at scale. Still, Oracle’s proactive shift to monthly patching is a clear signal that the industry is preparing for that possibility.

Broader Industry Context

Oracle’s move aligns with a wider recognition that traditional quarterly patching cycles are no longer sufficient in an era where AI can automate vulnerability research. Other vendors have already adopted monthly or even more frequent updates. By picking the third Tuesday, Oracle gives IT teams a dedicated week to handle urgent patches from both Oracle and other major vendors without overlap.

For security teams, the new schedule means more regular but smaller patch loads, which can simplify testing and reduce the risk of deployment failures. However, it also demands more consistent attention to patch management.

Looking Ahead

Oracle’s first monthly CSPU on May 28 will serve as a benchmark for the new process. Customers are advised to review the company’s new schedule details and plan their internal patching windows accordingly. As AI continues to evolve, further adjustments to patch cycles across the software industry are likely.

This article originally appeared on CSO.