DBAData and Oracle

Oracle out of support: the database still runs, but security is no longer covered

An unpatched Oracle database keeps processing orders and invoices, but with every bulletin it builds up known vulnerabilities. Which releases are covered, what is at stake and how to get out.

Strategic editorial team 27 July 2026 9 min read

Cover: “Oracle out of support: it runs, but it’s exposed”, Data and Oracle

An Oracle database that is out of support keeps working. The ERP system opens, orders come in, invoices go out. What stops is the flow of security fixes. Vulnerabilities discovered after the end of support stay open on that system, and they are described in public bulletins that anyone can read. So the risk is not a sudden failure. It is an exposure that grows with every bulletin, along with questions from customers, auditors and insurers that become hard to answer.

A typical scenario. At a distribution company, the ERP database has run on the same release for years. Nobody touches it, because it works and any intervention looks like a threat to the month-end close. Then a major customer sends its supplier security questionnaire: “Do your systems receive the vendor’s security updates?” The honest answer is no, and the issue lands on management’s desk.

What does “out of support” mean for an Oracle database?

Oracle gives each database release a three-stage support cycle, described in its Lifetime Support Policy:

Premier Support covers bug fixes and security patches as part of the support contract.
Extended Support adds a few more years of fixes and patches for some releases, for an extra fee.
Sustaining Support offers assistance with no end date, but no new patches.

In everyday language, “out of support” means a release that has reached the third stage, or an installation on which the company has stopped applying patches. The practical result is the same. Vulnerabilities discovered from that point on stay open.

Oracle says so in every bulletin. Security patches are provided only for releases covered by Premier Support or Extended Support. Oracle also points out that some attacks have succeeded because the targeted customers had not applied patches that were already available.

Which releases still receive patches?

The table summarises the dates Oracle has published for the most widely used releases.

Release	Available since	Patches under Premier Support until	Patches under paid Extended Support until	Status
11g (11.2)	September 2009	January 2015	December 2020	no new patches
12c (12.1)	June 2013	July 2018	July 2022	no new patches
12c (12.2)	March 2017	November 2020, then limited fixes until March 2022	not offered	no new patches
18c	July 2018	June 2021	not offered	no new patches
19c	April 2019	December 2029	December 2032	covered, long-term release
21c	August 2021	July 2027	not offered	covered until July 2027
26ai	October 2025 (on-premises on Linux since January 2026)	December 2031	to be confirmed	covered, new long-term release

Patches follow a public calendar. The quarterly cumulative fixes (Critical Patch Updates) come out on the third Tuesday of January, April, July and October. The latest was released on 21 July 2026 and the next is announced for 20 October. Since 28 May 2026 Oracle has also published monthly security updates in the other months (Critical Security Patch Updates). Anyone who stays on a release without coverage receives neither.

Why is an unpatched database more exposed with every bulletin?

Every Oracle bulletin lists the vulnerabilities it fixes, with their CVE code (the number under which a vulnerability is registered and made public), the product affected and the severity. For those who update, it is a reminder. For those looking for systems to attack, it is a map. Knowing which release is running on a server is enough to work out which flaws are still open.

Exposure grows even if nothing changes in the company. Each new bulletin adds vulnerabilities that will not be fixed on that release.
Known vulnerabilities are among the most widely used in attacks. The US cybersecurity agency (CISA) keeps a public catalogue of those already exploited in real attacks, precisely because the first line of defence is to close them.

A database is rarely reachable from the internet. But it can be reached from application servers, workstations and service accounts, and any of them can be compromised. Intruders who get into the network look precisely for the systems that have fallen behind on updates.

What do regulations, customers and insurers expect?

No regulation lists the database releases you are allowed to use. The rules require you to manage risk and to be able to demonstrate the choices you have made. For entities covered by NIS2, the EU directive on network and information security, there is also a specific measure on software that no longer receives updates.

NIS2 in Italy. Legislative Decree 138/2024 (Italy’s NIS2 law) requires essential and important entities to take risk management measures that also cover system maintenance, “including vulnerability handling and disclosure” (Article 24(2)(e), our translation). The basic measures issued by Italy’s National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale, ACN) in Determination 379907/2025 require, in measure PR.PS-02, that only software still covered by security updates is installed, unless there are justified and documented reasons and compensating measures are in place. For an entity covered by NIS2, then, an out-of-support database is an exception to be justified in writing, with a risk assessment and an exit date.
Supply chain. The same article requires attention to security in relationships with suppliers (point (d)). That is why companies covered by NIS2 send questionnaires to their suppliers, and a question about security updates is one of the most common.
Personal data. The GDPR requires security measures appropriate to the risk, chosen “taking into account the state of the art” (Article 32). A system with known, unfixed vulnerabilities struggles to meet that standard.
Insurance. If a cyber policy is taken out after a security questionnaire, the answers matter. In Italy, inaccurate statements by the policyholder can reduce the payout or, in the most serious cases, make the contract voidable (Articles 1892 and 1893 of the Italian Civil Code). Some policies may also set conditions on systems that are not kept up to date.

For businesses in San Marino the framework is different. It needs to be assessed case by case.

What can you do if an upgrade is not possible straight away?

Sometimes the upgrade cannot happen tomorrow. The ERP system may not be certified yet, the year-end close may be under way, or there may be no maintenance window. In that case you reduce the exposure with temporary measures, which do not replace patches.

Restrict who can reach the database. Allow only the application servers and administration workstations, with network rules that are written down and checked.
Tidy up user accounts. Remove unused and shared accounts, change default passwords and cut privileges back to what is needed.
Log access. Turn on auditing of sensitive operations and have a designated person read the logs at fixed intervals.
Test the restore. Schedule a test and record in a written report how long it takes to get back up and running.
Isolate what cannot be upgraded. If an old application ties you to the release, separate it from the rest of the network.
Set a date. These measures buy time, and that time must be spent on an exit plan with a written deadline.

For 19c, after December 2029, Oracle offers paid Extended Support until December 2032. It pushes the deadline back, and it should be weighed against a planned upgrade. For 11g, 12c and 18c this option no longer exists.

How do you plan the exit with a short downtime decided in advance?

A well-prepared upgrade follows a sequence that management, too, can check step by step.

Take stock of what you have. Record the release and patch level, edition, installed options, connected applications, overnight batch jobs and data volumes.
Check with the ERP vendor which Oracle releases the application is certified on. This is the constraint that most often decides the timing.
Choose the target. It can be 19c, with patches included until December 2029, or 26ai, covered until December 2031. You can upgrade directly to 26ai only from 19c or 21c. From older releases you go through an intermediate release, or you move the data into a new database. In addition, from 21c onwards Oracle supports only the multitenant architecture, in which each database is hosted inside a container. If you are coming from a 19c set up in the traditional way, you need to plan the conversion.
Test on a copy. Run the upgrade, check the applications and compare the timings of the most important queries.
Agree the window and plan the way back. The switch happens at a time agreed with the people who use the system, with a verified backup behind you and a plan to roll back if a check does not add up.

When downtime must be kept to a minimum, replication keeps the new database in sync while the old one carries on working, and the switch shrinks to a short window. Up-to-date dates and releases are in the versions and support dates panel.

In brief

An Oracle database that is out of support still works, but vulnerabilities discovered after the end of support stay open.
Patches are still issued for 19c (until December 2029, then for a fee until 2032), 21c (until July 2027) and 26ai (until December 2031). 11g, 12c and 18c no longer receive them.
NIS2, the GDPR, customers and insurers do not ban any release, but they expect you to manage the risk and be able to prove it. For entities covered by NIS2, software without updates is an exception that must be justified (ACN measure PR.PS-02).
If you cannot upgrade straight away, reduce the exposure and set an exit date.
The upgrade starts from the ERP system’s certification and is tested on a copy.

Frequently asked questions

Does an out-of-support Oracle database stop working?

No. The software works as before and Oracle still offers technical assistance, but there are no new patches. Vulnerabilities and bugs discovered after the end of support are no longer fixed for that release.

Is it worth going straight to 26ai?

It depends on your starting point and on the ERP system. 26ai has the longest coverage, but you can only upgrade to it directly from 19c or 21c, and it requires the multitenant architecture and certified applications. The route is decided after a test on a copy.

Upgrading a database with planned downtime kept to a minimum is the work of our Oracle & Database Engineering division. It covers a snapshot of releases and licences, an upgrade plan, tests on a copy and the switch in the agreed window. When the database is part of a wider security review, we work alongside our Cybersecurity division.

Sources

Consulted on 16 September 2026.

Find out moreOracle & Database EngineeringOracle database administration, outsourced or alongside your in-house team. Performance, tested backups, version upgrades and migrations.