Critical Patch Updates:
Critical Patch Updates are collections of security fixes for Oracle products. They are available to customers with valid support contracts. They are released on the Tuesday closest to the 17th day of January, April, July and October.
So it depends on your security patch policy.
But there are other types of patches: PSU(Patch Set Updates) and BP(Patch Bundle)
Here is the description from Oracle Database - Overview of Database Patch Delivery Methods - 12.1.0.2 and older (Doc ID 1962125.1) from https://support.oracle.com
Types of Proactive Patch (SPU / PSU / Bundle Patches)
(...)
- Security Patch Update (SPU)
- a cumulative collection of security fixes released as part of Oracle's Critical Patch Update (CPU) program
- (...)
- Patch Set Update (PSU):
- a cumulative collection of fixes for proven high impact bugs encountered in the field
- includes the security fixes that are released as part of the CPU program
- guaranteed not to contain any changes to the optimizer or fixes which change application behaviour
- (...)
- Bundle Patch (BP)
- a cumulative collection of fixes to address bugs in a given feature, product, or configuration
- a superset of PSU
- (...)
So maybe you want to patch with last PSU or BP to get fixes for bugs and mybe sume enhancements
You can download these patches only if you have a valid CSI (Customer Support Identifier)