AWS AmazonRDS high security documentation change

Service: AmazonRDS · 2026-07-10 · Security-related high

File: AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Oracle.Major.md

Summary

Added documentation for upgrading to Oracle Database 26ai, including version compatibility, architecture requirements, parameter changes, and security-related protocol updates.

Security assessment

The change explicitly documents security enhancements including mandatory TLS 1.2+ support and deprecation of weak cryptographic algorithms in NNE. These address vulnerabilities in older protocols and ciphers, directly impacting transport security and encryption strength.

Diff

diff --git a/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Oracle.Major.md b/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Oracle.Major.md
index 0e9cec2a1..ff87da9da 100644
--- a//AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Oracle.Major.md
+++ b//AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Oracle.Major.md
@@ -7 +7 @@
-Supported versions for major upgradesSupported instance classes for major upgradesGathering statistics before major upgradesAllowing major upgrades
+Supported versions for major upgradesSupported instance classes for major upgradesGathering statistics before major upgradesAllowing major upgradesUpgrading to Oracle Database 26ai
@@ -26,0 +27,2 @@ Make sure that you thoroughly test any upgrade to verify that your applications
+  * Upgrading to Oracle Database 26ai
+
@@ -33,0 +36,4 @@ Amazon RDS supports the following major version upgrades.
+###### Note
+
+Oracle Database 26ai is available only in Enterprise Edition.
+
@@ -36 +42,2 @@ Current version | Upgrade supported
-19.0.0.0 using the CDB architecture |  21.0.0.0  
+21.0.0.0 using the CDB architecture |  26.0.0.0  
+19.0.0.0 using the CDB architecture |  21.0.0.0, 26.0.0.0  
@@ -62,0 +70,34 @@ If you upgrade a major version using the console, you don't need to choose an op
+## Upgrading to Oracle Database 26ai
+
+You can perform a major version upgrade to Oracle Database 26ai (26.0.0.0) from the following source versions:
+
+  * Oracle Database 21c using the CDB architecture
+
+  * Oracle Database 19c using the CDB architecture
+
+
+
+
+Oracle Database 26ai supports only the CDB architecture. If your DB instance runs Oracle Database 19c as a non-CDB, first convert it to a CDB, and then upgrade it to Oracle Database 26ai. You can't change the database architecture during an upgrade. For more information, see [Converting an RDS for Oracle non-CDB to a CDB](./oracle-cdb-converting.html).
+
+After you convert a non-CDB to a CDB, the database uses the single-tenant configuration. To add tenant databases (PDBs), convert the database from the single-tenant configuration to the multi-tenant configuration. For more information, see [Converting the single-tenant configuration to multi-tenant](./oracle-single-tenant-converting.html).
+
+Before you upgrade to Oracle Database 26ai, review the following changes:
+
+  * Review the new and desupported parameters for Oracle Database 26ai. For more information, see [Amazon RDS parameter changes for Oracle Database 26ai (26.0.0.0)](./Oracle.Concepts.database-versions.html#Oracle.Concepts.FeatureSupport.26ai.parameters).
+
+  * Note the following changes to options:
+
+    * Oracle supports only TLS 1.2 or higher for the 26ai major engine version. This change affects the OEM agent and SSL options and their option settings, specifically the allowed cipher suites and TLS versions. For more information, see [Oracle Management Agent for Enterprise Manager Cloud Control](./Oracle.Options.OEMAgent.html) and [Oracle Secure Sockets Layer](./Appendix.Oracle.Options.SSL.html).
+
+    * Oracle Database 26ai supports only Oracle APEX version 24.1.v1 and higher. For more information, see [Oracle Application Express (APEX)](./Appendix.Oracle.Options.APEX.html).
+
+    * For the NNE option, Amazon RDS has desupported older hash functions and cryptographic algorithms for Oracle Database 26ai. For more information, see [Oracle native network encryption](./Appendix.Oracle.Options.NetworkEncryption.html).
+
+  * RDS for Oracle doesn't support the OEM Database Express and OLAP options in Oracle Database 26ai. Oracle desupported OEM Database Express and deprecated OLAP in Oracle Database 26ai. For more information, see [Oracle Enterprise Manager Database Express](./Appendix.Oracle.Options.OEM_DBControl.html) and [Oracle OLAP](./Oracle.Options.OLAP.html).
+
+  * RDS for Oracle doesn't support the Locator option in Oracle Database 26ai. Oracle Spatial supersedes Oracle Locator and includes its functionality. To use Locator functionality in Oracle Database 26ai, use the Oracle Spatial option instead. For more information, see [Oracle Locator](./Oracle.Options.Locator.html) and [Oracle Spatial](./Oracle.Options.Spatial.html).
+
+
+
+