Should you update to Java 21.0.13?
Yes, this week. Java 21.0.13 is a security update Oracle released on 20 Oct 2026 for Windows and Mac. It fixes 38 security flaws, 0 rated critical and 1 high by Oracle.[1] None of them is known to be used in attacks.
It is the newest Java 21 release, so it’s the one to have.
Should you update?
Yes, this week. It fixes 38 security flaws, and attackers study each release to work out what it fixed. Every security update closes holes that become public the moment it ships, so the risk of staying on the old version only grows. Waiting a week to see if others hit problems is a common habit; with a security update it’s the wrong trade.
Is Java 21.0.13 safe to install?
Yes. It’s Oracle’s own security release, and updates rarely go wrong; a backup makes it painless if one does. The one unsafe way to get it is from a link: Oracle never sends updates by email, text or pop-up, so install it only from java.com, or Java’s own updater on Windows.
What it fixes
Oracle lists 38 security flaws, 0 rated critical and 1 high by Oracle.[1] The critical or high one is:
| Flaw | Severity | What Oracle calls it |
|---|---|---|
CVE-2026-91415 | High | Java SE 2D |
How to update, and how long it takes
About five minutes. Close your browser and any Java programs first. If nothing you use needs Java, uninstalling it is safer still.
- On Windows, open the Start menu and search for “Check For Updates” (Java’s own updater).Click Update Now and follow the steps.
- On a Mac, or for a Java development kit (JDK),download the newest version of the same Java number from java.com or oracle.com/java and install it.
To check it worked: On Windows, Settings → Apps → Installed apps shows “Java 8 Update 511” or the JDK’s version. On a Mac, open Terminal and type java -version. It should say 21.0.13 or later.
Older devices
The same day, Oracle released Java 8u511 (103 security flaws), Java 27.0.1 (37 security flaws), Java 25.0.5 (39 security flaws), Java 17.0.21 (36 security flaws) and Java 11.0.33 (39 security flaws) for devices that stay on an older version. Each fixes the same holes where they apply.
21.0.12 vs 21.0.13
Java 21.0.12, released 21 Jul 2026, fixed 9 security flaws. Java 21.0.13 fixes 38 security flaws and includes the fixes before it, so going straight to 21.0.13 gets you both.
- Before: Java 21.0.12, 21 Jul 2026, 9 security flaws
- After: none yet. This is the newest.
- Java updates, every release and the latest version
- Updates, the latest version of everything HARD tracks
References
- ^ Oracle. “Oracle Critical Patch Update Oct 2026”, 20 Oct 2026.