Are there security fixes included? Which CVEs?

I received multiple questions from colleagues and customers over the past weeks regarding the security content in RUs and MRPs. See also my blog post from yesterday where I touched this topic briefly. The question regarding RUs, MRPS and CSPUs often is: Are there security fixes included? Which CVEs?

Photo by Gene Gallin on Unsplash

Release Updates are the primary vehicle

As I explained already, Release Updates (RU) are the primary and main vehicle to deliver security fixes. MRPs and CSPUs contain only a smaller portion, usually those fixes with really high CVE scores which can’t wait until we fix them in the coming Release Update.

This means: You need to use the current Release Update, and you may need to add the most recent MRP (Monthly Recommend Patch) on Linux for 19c or 26ai on top, or the most recent CSPU (Critical Security Patch Update) for all other platforms and versions.

And of course, as I wrote broadly about before, in order to do so, you must upgrade to Oracle Database 19c or Oracle AI Database 26ai. You should not operate and use older releases.

How many security fixes are included in the most recent RUs?

We can quickly find this out by using oradiff.oracle.com.

Go to: “Included Fixes” on the left-side menu, then choose “List of Fixes“.  When you compare now two RUs to each other, you can see all the included fixes in a given RU according to the inventory. Then “Actions” button between the Versions Selector and the displayed results and add a “Filter” via “matches regular expression” for “Fix for Bug” in the “Bug Description” column as shown below.

Adding a FILTER via the ACTIONS button in oradiff.oracle.com

Now you can see all the security fixes listed since the usually start with “Fix for Bug” with a bug number.

When we do this now for the most recent Release Updates, we get this graphic:

Overview on fix content and security fix content per Release Update from 19.25 to 19.32

You can easily see that we included a lot of security fixes into 19.32 compared to other RUs (whereas 19.27 remains a special case).

Can we see the same for MRPs?

In oradiff.oracle.com we list the MRPs (and CSPUs) as well. I do this here as an example for 19.31 and the available 5 MRPs as of now.

MRPs for Oracle Database 19c Release Update 19.31 – Security Content

Can you map this to CVEs?

When you check the README of any given MRP or CSPU, we list the CVEs as well (scroll towards the lower section of the READMEs). But we don’t map CVEs to individual bug numbers. Still, a recurring question was whether you can find out which CVEs are fixed with any given RU or MRP.

Choose “Included Fixes” on the left menu in oradiff.oracle.com, and then “List of CVEs”. Then select the releases you’d like to compare, for instance:

Version selector in oradiff.oracle.com allows the comparison of CVEs

Let me do this first for 19.32 as the plain RU compared to 19.32 with the MRP of September 15 applied on top:

CVE content for 19.32 Release Update – Plain RU vs MRP4

I cut off the list here – but all together, 17 CVEs are fixed. You can now access the CPU Alert (linked from the CPU column) and the MOS ID (liked in the right-most column) telling you more details about it.

Of course, you can do the whole selection also in a per-Release-Update basis – or compare 19.32 with MRP3 to the base release. You will find out that 243 CVEs are fixed in the most recent RU with the most recent MRP compared to the 19.3.0 base release from 2019.

Finally, please be aware that this information is strictly based on what you (and we) can see from READMEs, MOS notes and the inventories. There is no magic done here, and we don’t reveal any secrets. We just want to make your life easier in case you rely on this information for your internal documentation. Since I speak with many of you, I know that some teams have to document which CVEs are fixed in a given patch release. This should help you compiling the information together.

And please don’t ask to which bug number any given CVE maps. This information is not visible to us.

Further Links and Information

• CVE scores
• oradiff.oracle.com
• Why you can’t do n-1 anymore
• Clarifications about CPUs, CSPUs, MRPs and RUs
• More clarifications about CPUs, CSPUs, MRPs, RUs
• Patch your database against AI-enabled cybersecurity threats
• Accelerating Vulnerability Detection and Response at Oracle (3 min read – April 29, 2026)
• Take Action Today: Protect Your Oracle Database Against AI-Enabled Cybersecurity Threats (1 min read – April 30, 2026)

–Mike