martinberger.swiss

Database

Oracle 26ai - Stay Secure with Monthly Patches: MRP and CSPU via AutoUpgrade

7 min read

AutoUpgrade can build a fully patched Oracle 26ai ORACLE_HOME for you - including the latest Monthly Recommended Patch (MRP) with its security fixes - using two commands.

Why it matters: Oracle now ships security fixes every month. Doing this by hand means grabbing the Release Update, OPatch, the Data Pump bundle, and the MRP. AutoUpgrade pulls the whole set from My Oracle Support and installs it out-of-place, so your running database stays untouched until you are ready to switch.

The Big Picture - Monthly Patching in 2026

Oracle changed its patch delivery in 2026: security fixes now ship every month, not just every quarter.

The key link: CSPU fixes are included in the Database and Grid Infrastructure MRPs. So when you apply the monthly MRP, you also get that month’s critical security fixes. The quarterly CPU stays cumulative and rolls up every CSPU released in the quarter. Mike Dietrich explains this monthly delivery model well in Patch your databases against AI-enabled cybersecurity threats .

AutoUpgrade can download and install RUs, MRPs, and one-off patches with out-of-place patching. For the May 2026 cycle on 26ai the relevant patch is Database MRP 23.26.2.0.0 (May 2026), patch 39345754.

Useful references:

What’s Inside the MRP

The patch README (Patch 39345754 - DATABASE MRP 23.26.2.0.0 May 2026) tells you a few things before you start:

  • It’s cumulative. The latest MRP already contains every earlier MRP. You only ever apply the newest one.
  • It needs the matching RU. The home must already be on Database Release Update 23.26.2.0.0.
  • It’s RAC Rolling Installable - patch one node at a time, no full outage.
  • It’s Data Guard Standby-First Installable - patch the standby first to cut risk and downtime (MOS Doc 1265700.1).
  • It needs OPatch 12.2.0.1.51 or later.
  • Some fixes are online-installable - they can go in while the database stays up. The rest need a short shutdown.

Two Ways to Apply It - and Why I Pick Out-of-Place

Oracle’s README describes the classic way, in-place route: shut the instances down, run opatch napply against the running home, start back up, then datapatch. There’s also an online variant (opatch napply ... -online) that applies the online fixes without dropping connections, leaving the rest for a later window.

That works. But I prefer building a fresh ORACLE_HOME and switching to it - out-of-place patching. Here’s why:

  • The running home is never touched. If something looks wrong, you just stay on the old home - no rollback under pressure.
  • Rollback is a switch, not a patch removal. Point back at the old home and restart.
  • AutoUpgrade does the lifting for me - clone, patch, and datapatch in one run, as shown below.

The in-place opatch napply method is perfectly valid. This post just shows the out-of-place path, which I find safer and easier to repeat.

BTW: AutoUpgrade works completely offline too - just execute the download part on a host with internet access and then copy the files to target environment.

My Test Setup

  • Oracle 26ai - 23.26.2.0.0, Enterprise Edition
  • Oracle Linux 9
  • ORACLE_BASE=/u01/app/oracle
  • AutoUpgrade JAR directory: /u01/app/oracle/autoupgrade
  • Patch download directory: /u01/app/oracle/autoupgrade/patch

Step 1 - Prepare the Directories

$ cd /u01/app/oracle/autoupgrade
$ mkdir keystore
$ mkdir logs
$ mkdir patches

Step 2 - Get the Latest AutoUpgrade

Always use the newest AutoUpgrade. Patching features change. No MOS login required.

$ cd /u01/app/oracle/autoupgrade
$ wget https://download.oracle.com/otn-pub/otn_software/autoupgrade.jar

Step 3 - Configure the Download - download.config

The RECOMMENDED,MRP keyword tells AutoUpgrade to fetch the latest Release Update plus the matching MRP.

global.global_log_dir=/u01/app/oracle/autoupgrade/logs
global.keystore=/u01/app/oracle/autoupgrade/keystore

patch1.patch=RECOMMENDED,MRP
patch1.target_version=23
patch1.platform=LINUX.X64
patch1.folder=/u01/app/oracle/autoupgrade/patch
patch1.target_home=/tmp/dummy_home

Step 4 - Store Your MOS Credentials

AutoUpgrade needs My Oracle Support credentials to download patches. Load them once into the keystore.

$ java -jar autoupgrade.jar -config download.config -patch -load_password

See the command-line parameters documentation for how to create the credentials.

Step 5 - Download the Patches

$ java -jar autoupgrade.jar -config download.config -patch -mode download
AutoUpgrade Patching 26.3.260401 launched with default internal options
Processing config file ...
Loading AutoUpgrade Patching keystore
AutoUpgrade Patching keystore is loaded

Connected to MOS - Searching for specified patches

------------------------------------------------------
Downloading files to /u01/app/oracle/autoupgrade/patch
------------------------------------------------------
DATABASE RELEASE UPDATE 23.26.2.0.0
    File: p39099680_230000_Linux-x86-64.zip - VALIDATED

OPatch 12.2.0.1.51 for DB 23.0.0.0.0 (Apr 2026)
    File: p6880880_230000_Linux-x86-64.zip - VALIDATED

DATAPUMP BUNDLE PATCH 23.26.2.0.0
    File: p39227161_2326200DBRU_Generic.zip - VALIDATED

DATABASE MRP 23.26.2.0.0 MAY 2026
    File: p39345754_2326200DBRU_Linux-x86-64.zip - VALIDATED

autoupgrade.jar 26.3 (April 2026)
    File: autoupgrade.jar - VALIDATED
------------------------------------------------------

The MRP May 2026 (patch 39345754) is downloaded and ready to use.

$ ll
total 2442892
drwxrwxr-x. 2 oracle oinstall       4096 Jun  2 16:05 .
drwxr-xr-x. 6 oracle oinstall        158 Jun  2 16:09 ..
-rw-r--r--. 1 oracle oinstall    7016621 Jun  2 16:05 autoupgrade.jar
-rw-r--r--. 1 oracle oinstall 2457466941 Jun  2 16:05 p39099680_230000_Linux-x86-64.zip
-rw-r--r--. 1 oracle oinstall    2254761 Jun  2 16:05 p39227161_2326200DBRU_Generic.zip
-rw-r--r--. 1 oracle oinstall    9412529 Jun  2 16:05 p39345754_2326200DBRU_Linux-x86-64.zip
-rw-r--r--. 1 oracle oinstall   25351666 Jun  2 16:05 p6880880_230000_Linux-x86-64.zip
-rw-r--r--. 1 oracle oinstall       1875 Jun  2 16:05 patches_info.json

Step 6 - Create the Patched ORACLE_HOME - create_home.config

This config builds a brand-new home with the RU and MRP already applied.

global.global_log_dir=/u01/app/oracle/autoupgrade/logs
install1.patch=RECOMMENDED,39345754
install1.target_version=23
install1.folder=/u01/app/oracle/autoupgrade/patch
install1.target_home=/u01/app/oracle/product/23.0.0/dbhome_2
install1.home_settings.oracle_base=/u01/app/oracle
install1.home_settings.edition=EE
install1.home_settings.inventory_location=/u01/app/oraInventory
install1.download=no

Watch out - use the MRP patch number here, not the MRP keyword. As of early May 2026, install1.patch=RECOMMENDED,MRP does not work for create_home. Use the patch number (39345754) instead. This will likely be fixed in a later AutoUpgrade release.

If you use the MRP keyword for the create step, you get this error:

There were conditions found preventing AutoUpgrade Patching from successfully running

*Validating Oracle Patch files
An MRP patch file is not found in /u01/app/oracle/autoupgrade/patch for 23.26.2 RU for the job with prefix install1

Run the create:

$ java -jar autoupgrade.jar -config create_home.config -mode create_home -patch -noconsole

AutoUpgrade walks through the stages on its own - extract the gold image, install the home, then patch it (Data Pump bundle, then the RU/MRP merge). All-in-one!

$ java -jar autoupgrade.jar -config create_home.config -mode create_home -patch -noconsole
AutoUpgrade Patching 26.3.260401 launched with default internal options
Processing config file ...
+-----------------------------------------+
| Starting AutoUpgrade Patching execution |
+-----------------------------------------+
Job 100 database create_home_1
+----+-------------+-------+---------+-------+----------+-------+---------------------+
|Job#|      DB_NAME|  STAGE|OPERATION| STATUS|START_TIME|UPDATED|              MESSAGE|
+----+-------------+-------+---------+-------+----------+-------+---------------------+
| 100|create_home_1|EXTRACT|EXECUTING|RUNNING|  09:05:04|29s ago|Extracting gold image|
+----+-------------+-------+---------+-------+----------+-------+---------------------+
Total jobs 1

+----+-------------+-------+---------+-------+----------+-------+----------------------+
|Job#|      DB_NAME|  STAGE|OPERATION| STATUS|START_TIME|UPDATED|               MESSAGE|
+----+-------------+-------+---------+-------+----------+-------+----------------------+
| 100|create_home_1|INSTALL|EXECUTING|RUNNING|  09:05:04|17s ago|Installing ORACLE_HOME|
+----+-------------+-------+---------+-------+----------+-------+----------------------+
Total jobs 1

+----+-------------+-----------+---------+-------+----------+-------+---------------------------------+
|Job#|      DB_NAME|      STAGE|OPERATION| STATUS|START_TIME|UPDATED|                          MESSAGE|
+----+-------------+-----------+---------+-------+----------+-------+---------------------------------+
| 100|create_home_1|OH_PATCHING|EXECUTING|RUNNING|  09:05:04| 8s ago|DATAPUMP BUNDLE PATCH 23.26.2.0.0|
+----+-------------+-----------+---------+-------+----------+-------+---------------------------------+
Total jobs 1

+----+-------------+-----------+---------+-------+----------+-------+----------------------------------------+
|Job#|      DB_NAME|      STAGE|OPERATION| STATUS|START_TIME|UPDATED|                                 MESSAGE|
+----+-------------+-----------+---------+-------+----------+-------+----------------------------------------+
| 100|create_home_1|OH_PATCHING|EXECUTING|RUNNING|  09:05:04|20s ago|MERGE ON DATABASE RU 23.26.2.0.0 OF 3929|
+----+-------------+-----------+---------+-------+----------+-------+----------------------------------------+
Total jobs 1

Job 100 completed
------------------- Final Summary --------------------
Number of databases            [ 1 ]

Jobs finished                  [1]
Jobs failed                    [0]
Jobs restored                  [0]
Jobs pending                   [0]

# Run the root.sh script as root for the following jobs:
For create_home_1 -> /u01/app/oracle/product/23.0.0/dbhome_2/root.sh

Please check the summary report at:
/u01/app/oracle/autoupgrade/logs/cfgtoollogs/patch/auto/status/status.html
/u01/app/oracle/autoupgrade/logs/cfgtoollogs/patch/auto/status/status.log

Don’t forget root.sh. AutoUpgrade reminds you to run it as root for the new home: /u01/app/oracle/product/23.0.0/dbhome_2/root.sh. The summary report under .../status/status.html shows exactly what was applied.

Step 7 - What’s Next

Your new home is built and patched. From here you stay in AutoUpgrade for the rest of the move:

  • ANALYZE - check the database for issues before touching it
  • FIXUP - apply the recommended pre-patch fixes
  • DEPLOY - move the database onto the new, fully patched home

The result: you are running on the latest, secure Oracle 26ai with that month’s CSPU fixes already in place.

The Bottom Line

AutoUpgrade matches perfectly with the new Oracle patch strategy. You can keep 26ai current without hand-applying each patch. And: this is perfect for automation. The current issue for now: pass the MRP patch number, not the keyword, when you build the new ORACLE_HOME - but i am looking forward this is is fixed asap.