Oracle's monthly patch cycle: Run classic apps securely and add AI now    

If your organization runs Oracle E-Business Suite, PeopleSoft, JD Edwards or Siebel, the security patching timetable behind those systems tripled this year.

Since late May, Oracle has released security fixes every month, whereas it used to release them quarterly. Four patch events a year became twelve, but few support teams grew to match.

The release due on October 20 closes the first full quarter under the new rhythm, which makes this a fair moment to ask whether your organization has absorbed the change or only coped so far. The answer matters beyond security, because it shapes how quickly you can put AI to work on these applications.

Oracle began issuing monthly critical security patch updates (CSPUs) on May 28; quarterly updates continue as before. Oracle links the faster pace to AI models that uncover software flaws much sooner, so there’s little reason to expect a return to the old schedule. Oracle’s September update alone contained 673 new security patches.

Who does the work depends on where the application runs. Oracle patches the cloud services it manages. Everything else is yours, including classic applications hosted on Oracle Cloud Infrastructure (OCI). Oracle supports the infrastructure underneath, while your team keeps the database and the application. Many executives assume the move to OCI settled the matter, so it’s worth confirming the split with your CISO.

Why staying is still a sound decision

Although a heavier patch calendar may seem like another argument to leave these applications, the facts don’t support that view. Oracle has committed to Premier Support through at least 2037 for all four product lines and reviews that date every year.

These systems also hold something a migration can’t easily reproduce: often two decades of business process refined into customizations that work, which makes reimplementation risky and expensive. The more useful question is how to run these applications securely and what to build on top of them.

The new cadence presses on three weak points.

1. Proof: Regulators and auditors want evidence that critical fixes are in place. Reporting built for a quarterly cycle can confirm that last quarter’s update went in, yet it struggles to show whether anything critical is outstanding. A planned deferral then looks like an oversight.
2. Downtime: Utilities, public agencies and energy companies negotiate maintenance windows carefully. Four events a year fit within them. Twelve don’t, unless the work itself changes. Waiting for the quarterly release is a legitimate choice, though it can leave a serious flaw open for up to 3 months. This provides an attack footprint for the next agent, using frontier LLMs that escape into the wild.
3. People: After every patch, someone has to confirm that orders still flow, payroll still runs and the plant still operates. That check often rests on two or three people who were there when the system was built. If each round takes them a week, twelve rounds consume nearly a quarter of their year. The arrangement holds until one of them retires.

All three weak points share a remedy: turn patching into a routine that no longer depends on a few individuals.

DXC helps clients achieve that by using AI to automate the checks that specialists repeat after every patch and capturing their judgment before they move on. Evidence is then produced continuously, so a deliberate deferral is recorded as a decision and a missed fix is visible immediately.

DXC (an Oracle global partner for more than 35 years) runs Oracle environments day-to-day for organizations that can’t afford interruptions. 

• Guam Waterworks Authority, a JD Edwards user for more than two decades, moved to a current release on OCI and engaged DXC as its managed services partner. 

• Ballarat Health Services credits DXC with 9 years of dependable managed services for its critical patient administration system. 

• Manufacturer Staughton Group and education provider Navitas took similar routes.

• Telent, a leading provider of critical infrastructure in the UK and Ireland, tapped into DXC’s expertise to quickly migrate IT resources to public clouds and for ongoing IT support, increasing operational agility and reducing costs.

• For Multifonds, DXC delivered a full-stack managed services solution for Oracle Cloud Infrastructure (OCI) tailored to Multifonds' needs.

In each case, a partner equipped for routine upkeep handles it, leaving the client’s specialists free to improve how the organization works.

Take DXC’s Oracle Classic Estate Check, a short self-assessment of where the monthly cadence puts your estate under pressure. Then bring your results to Oracle AI World  in Las Vegas (October 25-28, booth #10030) and go through them with a DXC Oracle specialist. For more inquiries about the event, send us an email here.

Business leaders increasingly want AI on these applications, and the standard reply is that a move to Oracle Fusion must come first. That reply turns a 1-year ambition into a risky and costly multi-year program.

A different sequence is available. Keep the classic application as the system of record, place AI agents on top of it through the interfaces it already has and keep patching under control beneath. Agents can speed approvals, handle employee pay and leave queries, dealing with repetitive support work without altering the application.

DXC (a PeopleSoft Innovation Partner for 2025) is demonstrating agents of this kind on PeopleSoft and E-Business Suite at Oracle AI World this month.

Fusion may still prove the right destination. It then becomes a choice made on its merits and on your timetable.

Three questions to settle before the next patch

The monthly rhythm is here to stay, with further releases due on November 17 and December 15. Before then, leaders responsible for these applications should be able to answer three questions.

1. Which parts of our Oracle estate does Oracle patch, and which parts fall to us?
2. Could we prove today that no critical fix is outstanding?”
3. Who validates each patch, and what happens when they leave?

If any answer is uncertain, make patching an operating model decision this quarter and give it an executive owner. Organizations that get the routine right protect the systems that run the business and earn the freedom to add AI on their own schedule.

Learn more

• DXC-Oracle practice 
• Enterprise Applications Services for Oracle
• Cybersecurity Services