July 2026 Oracle RU Patch Numbers Every DBA Must Know (19c / 21c / 23ai → 26ai)

Published Aug 2026 · 7 min read

Oracle's July 2026 Critical Patch Update landed on 21 July 2026, and it is the largest CPU cycle Oracle has shipped to date — 1,449 new security patches across the product line, with the database server's headline fix rated CVSS 9.9. If you patched from our April 2026 RU patch guide, this is your next mandatory checkpoint: RU 19.32 for 19c, 21.23 for 21c, and 23.26.3 for Oracle AI Database 23ai → 26ai.

Below are the patch IDs as published across multiple public trackers (Mike Dietrich's upgrade blog, markusdba.de, DBsGuru, dbainsight, AWS RDS release notes and Oracle's own docs), plus what actually changed in each RU and the field-tested apply order. Two things make this cycle unusual — and more urgent than a normal quarter. First, Oracle's database security chief published a rare pre-release warning urging customers to apply this RU immediately on availability, because AI tooling is shrinking the time between patch release and working exploits. Second, the fixes close CVE-2026-61211 (DBMS_CLOUD, CVSS 9.9) and CVE-2026-47040 (Connection Manager, CVSS 9.1, exploitable without authentication) — about half a dozen of this cycle's database vulnerabilities need no login at all.

Section 1: Oracle patch checklist — July 2026 RUs (exact patch IDs)

Oracle Database 19c — RU 19.32.0.0.260721

• Database RU (UNIX/Linux): Patch 39472050
• Grid Infrastructure RU (UNIX/Linux): Patch 39467003
• Combo OJVM + DB RU: Patch 39618649 — for Java-in-DB workloads (EBS, Forms, SOA, custom JVM PL/SQL)
• Combo OJVM + GI RU: Patch 39618711 — single-pass RAC + OJVM apply
• OJVM standalone (all platforms): Patch 39222882
• MS Windows BP (32 + 64-bit): Patch 39418910
• Exadata Q-Full-Stack: Patch 39619107 †

One caution while downloading: at least one popular tracker briefly listed 39618711 for both 19c combo patches. That is a typo — 39618711 is the GI-side combo; the OJVM + DB combo is 39618649. Check the patch title on the download page before staging.

Oracle Database 21c — RU 21.23.0.0.260721

• Database RU (UNIX/Linux): Patch 39549189
• Grid Infrastructure RU (UNIX/Linux): Patch 39549137 †
• MS Windows BP (32 + 64-bit): Patch 39300496 †
• Exadata Q-Full-Stack: Patch 39619112 †
• Reminder: 21c has no separate OJVM or Combo patch — OJVM fixes ship inside the DB RU and GI RU.

Oracle AI Database 23ai → 26ai — RU 23.26.3.0.0

• Database RU (UNIX/Linux): Patch 39578879
• Grid Infrastructure RU (UNIX/Linux): Patch 39568945
• Grid GoldImage: Patch 39581618 — fresh install + patch in one step
• Database GoldImage: Patch 39581612
• Client GoldImage: Patch 39599083
• Exadata Q-Full-Stack: Patch 39619127 †

† These IDs were published on a single public tracker (with the Exadata full-stack patches carrying a 28-July availability date, a week behind the main RUs). Quarterly full-stack and platform-bundle IDs are officially listed only in My Oracle Support Doc 888828.1 / the RU availability notes — confirm there before staging. And as always, read the official Oracle Critical Patch Update advisory for July 2026 before downloading anything — IDs are stable, but per-platform availability dates vary.

Section 2: What actually changed — DBA view

1️⃣ Oracle 19c — RU 19.32

This is not a routine RU. Per Mike Dietrich, 19.32 carries 671 fixes on top of 19.31 — 527 of them security-relevant "fix for bug" entries. Three changes deserve your attention before the change ticket is written:

• Next-generation cryptographic provider. 19.32 introduces an OpenSSL-based crypto provider alongside the legacy one, bringing TLS 1.3, FIPS 140-3, and post-quantum cryptography (ML-KEM key exchange, ML-DSA signatures) to 19c. The legacy provider stays default — you switch deliberately via set_crypto_provider.py — so nothing breaks on apply, but security teams planning PQC roadmaps suddenly have a 19c answer.
• Database Vault tightening that can bite existing jobs. DV realm authorization is now enforced consistently on DBMS_SCHEDULER create/alter/drop operations, and DBMS_REDEFINITION now runs full realm and command-rule checks. Translation: scheduler jobs that ran fine for years can start throwing ORA-01031 after 19.32 until you grant realm authorization. Test in pre-prod first if you run Database Vault.
• Behavior change: SQL containing BFILENAME is no longer cached in the Result Cache and no longer shows Result Cache steps in plans. If a report suddenly changes plan shape after patching, check this before blaming the optimizer.

Also important — what 19.32 is not: it is not a Long-Term RU. Oracle paused the LTRU program effective 1 May 2026, so 19.28 remains the only Long-Term RU (with MRPs through January 2027). If your patching standard said "we'll jump LTRU to LTRU," that plan needs a rethink this quarter.

2️⃣ Oracle 21c — RU 21.23

Despite recurring rumours, 21c did not fall off the RU train — 21.23 shipped on CPU day, and AWS RDS has already bundled it. But the clock is real: 21c is an Innovation Release with no Extended Support, and error correction currently runs to 31 July 2027 — roughly four quarterly RUs left. If you run 21c in production, the July window is a good moment to schedule the move to a long-term release (19c today, 23ai/26ai as the target that survives the decade). Our Oracle patching and upgrade training covers exactly this migration path, AutoUpgrade included.

3️⃣ Oracle AI Database 23ai → 26ai — RU 23.26.3

Still numbered on the 23.26.x train (Oracle did not renumber to 26.x), and this one is a genuine feature drop, not just fixes:

• AI Vector Search: distributed HNSW indexes gain scalar quantization — compressed vector representations that preserve similarity, a direct memory-footprint win on large vector tables.
• Redis protocol compatibility: the database can now speak Redis — cache workloads can point at Oracle without a separate cache tier.
• Private AI support for LLMs, reranking and text classification inside the database — for shops that cannot send data to external AI endpoints.
• Per-PDB redo generation management — long-requested control for consolidation platforms.
• Data Guard: transport-lag-based and log-buffer-space-based automatic redo prioritization, plus smarter drain timing on switchover.

Verdict: the CVSS 9.9 DBMS_CLOUD fix affects every release from 23.4.0 through 23.26.2, so if you are on the 26ai train, 23.26.3 is non-negotiable — the feature list is just the reward for patching promptly.

Section 3: Recommended patching strategy (field-tested)

Apply order: GI first, then DB, then OJVM

For RAC and Exadata the only safe sequence remains: GI RU (rolling) → DB RU (rolling) → OJVM, with the Combo patches letting you collapse two steps into one apply. Update OPatch everywhere first — patch 6880880, version 12.2.0.1.52 at the time of writing.

# Baseline before patching
$ORACLE_HOME/OPatch/opatch lsinventory > /tmp/lsinv_before_$(date +%F).txt

# 19c: apply GI RU (rolling) on each node, then DB RU
$GRID_HOME/OPatch/opatchauto apply /stage/39467003
$ORACLE_HOME/OPatch/opatchauto apply /stage/39472050

# Or the Combo OJVM+DB in one go
$ORACLE_HOME/OPatch/opatchauto apply /stage/39618649

# Run datapatch after every DB RU
$ORACLE_HOME/OPatch/datapatch -verbose

# Verify
$ORACLE_HOME/OPatch/opatch lsinventory > /tmp/lsinv_after_$(date +%F).txt
diff /tmp/lsinv_before_*.txt /tmp/lsinv_after_*.txt

Four non-negotiables this quarter

• Patch faster than usual. Oracle's own security leadership warned — before this CPU even shipped — that AI-assisted reverse engineering is collapsing the gap between patch release and working exploits. With unauthenticated network CVEs in this cycle, "next quarter" is not a plan.
• Never skip more than two RUs on 19c — and remember MRPs/CSPUs only cover the current and previous RU.
• lsinventory before AND after, kept for audit and rollback debugging.
• datapatch -verbose after every DB RU. The number of teams that skip it and then chase phantom plan changes has not gone down.

Section 4: Quick takeaways

• July 2026 is the biggest CPU Oracle has ever shipped — 1,449 patches, headline database fix CVSS 9.9 (DBMS_CLOUD), plus an unauthenticated Connection Manager hole. Patch on this quarter's schedule, not next quarter's.
• 19c → 19.32 brings 671 fixes, TLS 1.3/FIPS 140-3/post-quantum crypto — and a Database Vault change that can break scheduler jobs. It is not an LTRU; 19.28 keeps that crown.
• 21c → 21.23 keeps the lights on, but error correction ends July 2027 — start the exit plan.
• 23ai/26ai → 23.26.3 is mandatory (CVSS 9.9 fix) and generous: vector-index compression, Redis compatibility, private LLM support, per-PDB redo control.
• Exadata full-stack bundles lagged a week behind the main RUs this cycle — confirm QFSDP IDs on MOS Doc 888828.1 before staging.

FAQ

What is the exact 19.32 DB RU patch number for July 2026?

Patch 39472050 (RU 19.32.0.0.260721) for UNIX/Linux. GI RU is 39467003, OJVM standalone is 39222882, and the Combo OJVM+DB is 39618649.

What is the July 2026 RU patch for Oracle 23ai / 26ai?

DB RU is Patch 39578879 and GI RU is Patch 39568945 (RU 23.26.3.0.0). GoldImages: 39581612 (DB), 39581618 (Grid), 39599083 (Client).

Is 19.32 a Long-Term Release Update?

No. Oracle paused the Long-Term RU program effective 1 May 2026, so 19.28 remains the only LTRU, with MRPs through January 2027. 19.32 is a standard quarterly RU.

Did Oracle 21c get a July 2026 RU?

Yes — RU 21.23.0.0.260721, DB RU Patch 39549189. Note that 21c error correction currently ends 31 July 2027, so plan your migration to 19c or 23ai/26ai now.

Why is Oracle telling everyone to patch immediately this time?

Ahead of this CPU, Oracle's database security SVP published an unusual warning that AI models are dramatically accelerating how fast attackers reverse-engineer patches into exploits — and this cycle contains database vulnerabilities exploitable over the network without authentication. The window between "patch available" and "exploit in the wild" is the shortest it has ever been.

Learn to apply these patches on real systems

Reading patch numbers is the easy part — applying a rolling RU across a RAC cluster with a rollback plan is what separates production DBAs. Our live Oracle patching and upgrade training has you run opatchauto, datapatch, and full rollback drills on real clusters under instructor supervision, and the broader live Oracle DBA training programs cover 19c through 26ai end to end, patching cadence included. For version-specific details, keep Oracle's 19.32 Release Update new-features notes open while you plan the window.