AWS Security ChangesHomeSearch

AWS AmazonRDS: Clarify Oracle RU/MRP patching and automatic upgrade behavior

Service: AmazonRDS · 2026-10-02 · Documentation medium

File: AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Oracle.Minor.md

Summary

Rewrites the RDS for Oracle minor version upgrade documentation to clarify that quarterly engine versions contain an RU plus an MRP, that MRPs include a Critical Security Patch Update (CSPU), that the mrp-date field identifies the applied MRP, and that automatic minor version upgrades apply quarterly RUs but not MRPs (which must be applied manually).

Security assessment

The change is documentation-only but explicitly describes security patch delivery: MRPs carry a Critical Security Patch Update and are NOT applied by automatic minor version upgrades, so customers must apply them manually to stay patched. This is security-relevant patching guidance rather than a fix for a specific vulnerability, so it is medium severity.

Evidence

+RDS for Oracle releases a new quarterly RU engine version for Oracle Database 19c (19.0.0.0) and Oracle Database 26ai (26.0.0.0) each quarter. In the months between quarterly RUs, RDS for Oracle can also release engine versions that add a Monthly Recommended Patch (MRP) to the current RU. An RU includes the patches that Oracle releases for the specified quarter. An MRP includes a Critical Security Patch Update (CSPU) and other fixes that Oracle recommends.

Diff

diff --git a/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Oracle.Minor.md b/AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Oracle.Minor.md
index 748edee..af1f2a7 100644
--- a//AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Oracle.Minor.md
+++ b//AmazonRDS/latest/UserGuide/USER_UpgradeDBInstance.Oracle.Minor.md
@@ -11 +11 @@ Release Updates (RUs) and Supplemental Patch Bundles (SPBs)Release updates and m
-In RDS for Oracle, a minor version upgrade is an update to a major DB engine version. In RDS, a minor engine version is a Release Update (RU), a Supplemental Patch Bundle (SPB), or an RU paired with a Monthly Recommended Patch (MRP). For example, if your DB instance runs major version Oracle Database 19c and minor version 19.0.0.0.ru-2025-10.rur-2025-10.r1, you can upgrade your DB engine to minor version 19.0.0.0.ru-2026-01.rur-2026-01.r1. RDS for Oracle doesn't support minor version downgrades.
+In RDS for Oracle, a minor version upgrade is an update to a major DB engine version. In RDS, a minor engine version is a Release Update (RU), a Supplemental Patch Bundle (SPB), or an RU with a Monthly Recommended Patch (MRP) applied. For example, if your DB instance runs major version Oracle Database 19c and minor version 19.0.0.0.ru-2025-10.rur-2025-10.r1, you can upgrade your DB engine to minor version 19.0.0.0.ru-2026-01.rur-2026-01.r1. RDS for Oracle doesn't support minor version downgrades.
@@ -87 +87 @@ Spatial Patch Bundle has been renamed to Supplemental Patch Bundle (SPB). SPBs n
-RDS for Oracle releases new minor engine versions of Oracle Database 19c (19.0.0.0) and Oracle Database 26ai (26.0.0.0) quarterly. Beginning with the July 2026 quarterly RU, each of these engine versions includes an RU component and an MRP component. An RU includes the patches that Oracle releases for the specified quarter. An MRP includes a Critical Security Patch Update and other fixes that Oracle recommends.
+RDS for Oracle releases a new quarterly RU engine version for Oracle Database 19c (19.0.0.0) and Oracle Database 26ai (26.0.0.0) each quarter. In the months between quarterly RUs, RDS for Oracle can also release engine versions that add a Monthly Recommended Patch (MRP) to the current RU. An RU includes the patches that Oracle releases for the specified quarter. An MRP includes a Critical Security Patch Update (CSPU) and other fixes that Oracle recommends.
@@ -110,0 +111,2 @@ The revision number.
+The `mrp-date` identifies the most recent MRP applied on top of the RU. In a quarterly RU engine version, the `mrp-date` matches the `ru-date`, which means that no MRP is applied on top of the RU.
+
@@ -115 +117 @@ Oracle can release an MRP in the months between quarterly RUs. A new MRP advance
-The MRP that ships with a quarterly RU is applied by automatic minor version upgrades along with that RU. An MRP that Oracle releases between quarterly RUs is not applied automatically; you apply it manually. For more information, see Turning on automatic minor version upgrades for Oracle.
+Automatic minor version upgrades apply quarterly RUs but not MRPs. To upgrade to an engine version with a newer MRP, apply the upgrade manually. For more information, see Turning on automatic minor version upgrades for Oracle.
@@ -125 +127 @@ You can upgrade to any higher Oracle Database 19c or Oracle Database 26ai engine
-###### Manual upgrades for between-quarter MRPs
+###### Manual upgrades for MRPs
@@ -127 +129 @@ You can upgrade to any higher Oracle Database 19c or Oracle Database 26ai engine
-For Oracle Database 19c and Oracle Database 26ai, automatic minor version upgrades apply new quarterly minor versions, including the MRP that ships with the quarterly RU. However, an MRP that Oracle releases between quarterly RUs isn't applied automatically. To upgrade a DB instance to a between-quarter MRP, apply the upgrade manually.
+For Oracle Database 19c and Oracle Database 26ai, automatic minor version upgrades apply quarterly RUs but don't apply MRPs. To upgrade a DB instance to an engine version with a newer MRP, apply the upgrade manually.