Should you update to Java 26.0.2?
Yes, soon. Java 26.0.2 is a security update Oracle released on 21 Jul 2026 for Windows and Mac. It fixes 9 security flaws, 0 rated critical and 2 high by Oracle.[1] None of them is known to be used in attacks.
It is the newest Java 26 release, so it’s the one to have.
Should you update?
Yes, soon. None of its fixes is known to be used in attacks yet. Automatic updates will install it for you. Every security update closes holes that become public the moment it ships, so the risk of staying on the old version only grows. Waiting a week to see if others hit problems is a common habit; with a security update it’s the wrong trade.
Is Java 26.0.2 safe to install?
Yes. It’s Oracle’s own security release, and updates rarely go wrong; a backup makes it painless if one does. The one unsafe way to get it is from a link: Oracle never sends updates by email, text or pop-up, so install it only from java.com, or Java’s own updater on Windows.
What it fixes
Oracle lists 9 security flaws, 0 rated critical and 2 high by Oracle.[1] The 2 critical and high ones are:
| Flaw | Severity | What Oracle calls it |
|---|---|---|
CVE-2026-41254 | High | Java SE 2D (Little CMS) |
CVE-2026-47063 | High | Java SE Libraries |
How to update, and how long it takes
About five minutes. Close your browser and any Java programs first. If nothing you use needs Java, uninstalling it is safer still.
- On Windows, open the Start menu and search for “Check For Updates” (Java’s own updater).Click Update Now and follow the steps.
- On a Mac, or for a Java development kit (JDK),download the newest version of the same Java number from java.com or oracle.com/java and install it.
To check it worked: On Windows, Settings → Apps → Installed apps shows “Java 8 Update 511” or the JDK’s version. On a Mac, open Terminal and type java -version. It should say 26.0.2 or later.
Older devices
The same day, Oracle released Java 8u501 (17 security flaws), Java 25.0.4 (9 security flaws), Java 21.0.12 (9 security flaws), Java 17.0.20 (9 security flaws) and Java 11.0.32 (11 security flaws) for devices that stay on an older version. Each fixes the same holes where they apply.
Before and after
- After: none yet. This is the newest.
- Java updates, every release and the latest version
- Updates, the latest version of everything HARD tracks
References
- ^ Oracle. “Oracle Critical Patch Update Jul 2026”, 21 Jul 2026.