October 2026 Oracle RU Patch Numbers Every DBA Must Know (19c / 21c / 23ai → 26ai)

Published Oct 2026 · 6 min read

Oracle's October 2026 Critical Patch Update landed on Tuesday, 20 October 2026 — the last quarterly cycle of the year, reported at 1,295 new security patches across Oracle's product line. If you followed our July 2026 RU patch guide, this is the next checkpoint: RU 19.33 for 19c, 21.24 for 21c, and 23.26.4 for Oracle AI Database 23ai → 26ai.

Below are the exact patch IDs, the behaviour changes in 19.33 that can break existing scripts (one of them hits RMAN), and a field-tested apply order with the commands. The 19c IDs are confirmed by two independent sources; the rest come from Google's oracle-toolkit patch metadata and are marked so you can confirm them on My Oracle Support before staging.

Section 1: Oracle patch checklist — October 2026 RUs (exact patch IDs)

Oracle Database 19c — RU 19.33.0.0.261020

• Database RU (UNIX/Linux): Patch 39915792
• Grid Infrastructure RU (UNIX/Linux): Patch 39922757 — bundles the DB RU plus OCW, ACFS, Tomcat and DBWLM sub-patches
• Combo OJVM + DB RU: Patch 40121635 † — for Java-in-DB workloads (EBS, Forms, SOA, custom JVM PL/SQL)
• Combo OJVM + GI RU: Patch 40121665 † — single-pass RAC + OJVM apply
• OJVM RU 19.33 (inside both combos): Patch 39803650 †
• OPatch: minimum 12.2.0.1.52 per the RU README; take the latest from patch 6880880 (12.2.0.1.54 at the time of writing)

How to read the combos: each combo zip contains two sub-folders. 40121635 unpacks to 39803650 (OJVM) and 39915792 (DB RU); 40121665 unpacks to 39803650 (OJVM) and 39922757 (GI RU). If a download page shows a different pair, stop and check the title — trackers have mixed up the two combos before.

Oracle Database 21c — RU 21.24.0.0.0

• Database RU (UNIX/Linux): Patch 40017330 †
• Grid Infrastructure RU (UNIX/Linux): Patch 40017336 †
• Reminder: 21c has no separate OJVM or Combo patch — OJVM fixes ship inside the DB and GI RUs.

Oracle AI Database 23ai → 26ai — RU 23.26.4.0.0

• Database RU (UNIX/Linux): Patch 40007731 †
• Grid Infrastructure RU (UNIX/Linux): Patch 40002013 †

† Published in Google's oracle-toolkit October 2026 patch metadata (merged 23 October 2026) and not yet on a second independent tracker when we checked. Windows bundle patches, GoldImages and Exadata full-stack IDs are deliberately not listed here — Oracle publishes them in My Oracle Support Doc 888828.1 (the Primary Note for Database Quarterly Release Updates), which is the only place to take them from. Read the official Oracle Critical Patch Update advisory for October 2026 before downloading anything.

Section 2: What actually changed — DBA view

1️⃣ Oracle 19c — RU 19.33

The README is quiet — no new plan-changing optimizer fixes are switched on automatically, and previously enabled ones stay as they were. The behaviour changes in Oracle's 19.33 Release Update notes are where the real work is:

• RMAN: CONFIGURE CHANNEL no longer accepts a password in the connect string. If your backup scripts persist a channel with CONNECT 'sys/...@db', that configuration stops working after 19.33. Move the credential into an Oracle wallet or the secure external password store before the patch window, not after the first failed backup.
• Function-based indexes and VPD. CREATE INDEX on a user-defined function now fails if the function's arguments are VPD-protected and the creating user lacks VPD bypass authorization. Index rebuild scripts run by application schemas are the usual victims.
• Mandatory auditing of direct SYS DML. Direct INSERT/UPDATE/DELETE by SYS on SYS.AUD$, SYS.FGA_LOG$ and the authorization dictionary tables (OBJAUTH$, USERAUTH$ and friends) now writes ORA$MANDATORY unified audit records. Old "purge AUD$ with a DELETE" housekeeping jobs will start generating audit rows — switch them to DBMS_AUDIT_MGMT.
• ASM file groups. Moving a file group to a new quota group needs only SYSASM; template use and moving files between file groups now go through ASM File Access Control.
• SYS.KUBSAGT lost PUBLIC execute. Big Data / Hadoop integration users need an explicit GRANT EXECUTE.
• Time zone files. The RU ships DST files up to version 46 (tzdata 2026b/2026c) into the Oracle home, but does not change any database's DST version — that remains a separate, downtime-requiring step.

And what 19.33 is not: a Long-Term Release Update. With the LTRU program paused since May 2026, 19.28 remains the only LTRU. Two known issues from the README are worth printing: a relink can reset permissions on $ORACLE_HOME/bin/extjob (breaking external scheduler jobs), and datapatch may log a set of ignorable errors (ORA-00942, ORA-00955, ORA-01430, ORA-01432, ORA-01434, ORA-04043, ORA-29830).

2️⃣ Oracle 21c — RU 21.24

21.24 shipped on CPU day as usual. The clock has not moved: 21c is an Innovation Release with no Extended Support, and error correction runs to 31 July 2027 — that leaves roughly three more quarterly RUs. If 21c is still in production, use this window to schedule the move to 19c or straight to 26ai with AutoUpgrade.

3️⃣ Oracle AI Database 23ai → 26ai — RU 23.26.4

23.26.4 is the fourth and final 26ai RU of 2026. Because RUs are cumulative, everything that arrived in 23.26.2 and 23.26.3 comes with it — including one caution: Mike Dietrich reported that a database with a deliberately minimal SGA failed to start after patching from 23.26.1/23.26.2 to 23.26.3. If you are jumping straight from an early 26ai RU to 23.26.4, check SGA headroom on small test and dev instances first. Oracle has already certified E-Business Suite 12.2 on 23.26.4 for Base Database Service, so EBS shops on OCI can plan the move this quarter.

Section 3: Recommended patching strategy (field-tested)

Apply order: GI first, then DB, then OJVM

For RAC and Exadata the sequence does not change: GI RU (rolling) → DB RU (rolling) → OJVM, with the combo patches collapsing two steps into one. Update OPatch in every home first.

# 0. OPatch version in every home (19.33 needs 12.2.0.1.52 or later)
$ORACLE_HOME/OPatch/opatch version
$ORACLE_HOME/OPatch/opatch lsinventory > /tmp/lsinv_before_$(date +%F).txt

# 1. Conflict check against the DB home before the window
cd /stage/39915792
$ORACLE_HOME/OPatch/opatch prereq CheckConflictAgainstOHWithDetail -ph ./

# 2. GI RU, rolling, as root on each node in turn (analyze first)
/u01/app/19.0.0/grid/OPatch/opatchauto apply /stage/39922757 -analyze
/u01/app/19.0.0/grid/OPatch/opatchauto apply /stage/39922757

# 3. datapatch once per database after all homes are patched
$ORACLE_HOME/OPatch/datapatch -verbose

# 4. Known issue from the README: restore extjob permissions (as root)
chown root $ORACLE_HOME/bin/extjob
chmod 4750 $ORACLE_HOME/bin/extjob

Then prove the patch is registered in the database, not just in the home:

SELECT patch_id, action, status, description, action_time
FROM   dba_registry_sqlpatch
ORDER  BY action_time DESC
FETCH FIRST 5 ROWS ONLY;

Four checks before you raise the change ticket

• Grep your RMAN configuration (SHOW ALL;) for any persistent channel with an embedded password — fix it before 19.33, not after.
• Search housekeeping jobs for direct DML on SYS.AUD$ or SYS.FGA_LOG$.
• Never skip more than two RUs on 19c — MRPs only cover the current and previous RU.
• Keep lsinventory before and after, and run datapatch after every DB RU. Most "the patch changed my plans" tickets trace back to a skipped datapatch.

Section 4: Quick takeaways

• October 2026 = 19.33 / 21.24 / 23.26.4, released 20 October 2026.
• 19c: DB RU 39915792, GI RU 39922757, Combo OJVM+DB 40121635, Combo OJVM+GI 40121665, OJVM 39803650.
• The RMAN password change is the one most likely to break something on patch night.
• 21c has about three RUs left; 26ai 23.26.4 closes the 2026 RU cycle.
• If you also prepare for interviews, patching questions come up in almost every senior DBA round — our backup and recovery interview scenarios cover the RMAN side.

Learn to apply these patches on real systems

Knowing the patch numbers is the easy part; applying a rolling RU across a RAC cluster with a tested rollback plan is the skill employers pay for. Our live Oracle patching and upgrade training has you run opatchauto, datapatch and rollback drills on real clusters, and the live Oracle DBA training programs cover 19c through 26ai end to end.