Oracle Identity Governance and OAM 12.2.1.4 lose Premier Support on December 31: upgrade to 14c or replace?

Oracle stops Premier SupportdefinitionThe stage you're in today. Your normal support fee pays for it, and Oracle keeps fixing bugs and security holes until it runs out. for Oracle Identity Governance and Oracle Access Management 12c at the end of December 2026. If your company signs people in or hands out access through either product, decide this quarter whether you upgrade to 14c, pay for Extended Support or replace it. This guide lays out the dates, what each option costs you in time and risk, and the upgrade order we'd use.

Nothing breaks on the first of January. Logins keep working and the nightly jobs keep running. What changes is the patch stream. Oracle's quarterly Critical Patch Updates are how security holes in these products get fixed, and the first one after Premier Support ends is due on January 19, 2027.

That patch stream has mattered a lot here. CISA lists two flaws in these exact versions as exploited in the wild. CVE-2025-61757 lets an attacker with no login take over Identity Manager over HTTP, and it affects 12.2.1.4.0 and 14.1.2.1.0. CVE-2021-35587 does the same to Oracle Access Manager 12.2.1.4.0. Both are rated 9.8 out of 10. Each one was fixed in a regular quarterly patch, which a system left on Sustaining SupportdefinitionThe stage you drop to without Extended Support. Oracle still helps and hands over old patches, but writes no new fixes or security patches. stops getting.

For a regulated business, the first cost is usually an audit finding. Auditors often look at the access system early, and "no longer gets vendor security fixes" is a hard thing to explain to them. The second cost is time. An OIG upgrade touches everything custom you've built on it, so it runs for months, and people who know Oracle IAM get harder to book as the date gets closer.

For engineers: the Lifetime Support Policy lists OIG, OAM, Oracle Unified Directory and Oracle Internet Directory together as 12.2.x, so the directory under your OIG install has the same clock. Each stage runs to the last day of its month. Oracle's Technical Support Policies say Extended SupportdefinitionAn optional paid stage after Premier. For OIG and OAM 12c it keeps patches coming to the end of 2027, but doesn't certify new third-party versions. is generally offered only on a product's terminal patch set, and you keep paying Premier fees as well. If you're still on 12.2.1.3, ask Oracle what that means for you before you count on Extended Support, and plan for two hops to 14c instead of one.

Oracle has also started monthly Critical Security Patch Updates in the months between the quarterly ones, and the next two land in November and December. Both arrive while 12c is still in Premier Support, so use them. A 12.2.1.4 system that's fully patched is also the documented starting point for the 14c upgrade.

We see four realistic moves. Most estates end up combining two of them, usually Extended Support as a bridge while an upgrade or a replacement finishes.

Upgrading is usually the shorter road when OIG works and people mostly complain about its age. You keep your roles, approval workflows and audit history, and Oracle says 14c is certified with 11g and 12c Oracle connectors. Replacing makes more sense when OIG has turned into a pile of custom Java that only one contractor understands, or when the company has already bought another governance or sign-in product and OIG is the holdout.

Be realistic about replacement timelines. Netwrix, which sells a competing product, writes that full-scope implementations on larger platforms often take more than 12 months. SailPoint's own case study on PG&E describes replacing a large OIM estate in eleven months. Either way, a replacement started this quarter won't finish before Premier Support ends, so price in Extended Support for the overlap.

If you look at replacing, check what each vendor actually publishes. We didn't find an official OIM migration guide from Microsoft, though it has one for SAP Identity Management. A moderator on Microsoft's Q&A site said in 2023 that direct inbound provisioning from OIM to Azure AD, now Entra ID, isn't supported. Saviynt's comparison page points to migration accelerators from service providers. Oracle's cloud option is Oracle Access Governance, a cloud IGA service, and Oracle's tutorials show it working alongside OIG rather than as a migration path. If you're torn, we can price both routes against your own inventory in an assessment.

Oracle's release notes and upgrade guides list the changes below. The first few decide whether your custom code survives. The rest decide how many application teams you'll need to call.

The out-of-place migration route has its own surprises, and they're easy to miss because the in-place and cloned routes don't hit them. Oracle's guide says it won't migrate user-defined fields created through Deployment Manager or ADF sandboxes, so custom fields and custom database indexes have to be created again on 14c. User passwords don't migrate either, so you'll need SSO or LDAP as the authentication source. And the 12c connector directory isn't copied, so somebody has to copy it by hand or download the 14c connector versions.

WebGates are kinder than most people expect. Oracle's certification matrix says the 14c OAM server works with 12.2.1.4 WebGates, so you don't have to replace every WebGate on cut-over night. There's one trap. Oracle warns that if the OAM server is upgraded and a WebGate isn't, SSL between them can fail, because 14c rejects MD5 certificates and TLSv1. Oracle's fix is to re-enable those in the server's Java security policy or to upgrade the WebGate. Pick one before the window, not during it.

Watch the database line. Oracle's launch blog mentioned 23ai, but the current certification matrix lists 19c, 21c and 26ai. Go by the matrix. Oracle also says the database has to be on a supported version before the upgrade starts, so a database upgrade may need its own window ahead of the IAM one.

Our Oracle identity page covers what we do on OAM and OIG, including Kubernetes builds and the old OAAM adaptive-access product, which left Extended Support in 2021.

# Java version the domain runs on
$ $JAVA_HOME/bin/java -version
# Installed patches in the 12c Oracle home
$ $ORACLE_HOME/OPatch/opatch lsinventory
# Readiness check from the 14c home. If it fails, you've learned it cheaply
$ cd $ORACLE_HOME/oracle_common/upgrade/bin
$ ./ua -readiness

Most teams end up squeezed like this because the identity platform was treated as finished after go-live. Oracle now ships 14c fixes and features as bundle patches, usually quarterly, applied in place with little downtime. Treat those like any other scheduled change, and the next end date won't be a fire drill.

We do this work alongside IAM teams, whether the answer turns out to be a 14c upgrade or a move to another governance product. You can hire Oracle IAM engineers for the upgrade stretch, and our identity governance practice covers the replacement route. If you'd rather start with a list of what's at risk, ask for an assessment.