Oracle Identity Management 12c Premier Support Ends December 31, 2026
Oracle's Lifetime Support Policy gives every Oracle Identity and Access Management 12c product a Premier Support end of December 2026. The Oracle Fusion Middleware Lifetime Support Policy document lists four rows under "Oracle Identity and Access Management 12c Releases": Oracle Access Management 12.2.x, Oracle Identity Governance 12.2.x, Oracle Unified Directory 12.2.x and Oracle Internet Directory 12.2.x. All four print the same cells: GA August 2017, Premier Support ending December 2026, Extended Support ending December 2027, Sustaining Support indefinite. The document's own note on dates applies: unless otherwise noted, each stage of support is provided through the last day of the month. So Premier Support for Access Manager, Identity Governance (the product long sold as Oracle Identity Manager) and the two directory servers at 12.2.1.x ends on December 31, 2026, and Extended Support on December 31, 2027. Oracle does not call either date end of life, and this guide does not either. What the dates change is the Oracle support stage the software sits in, and for an identity system the stages differ in the one thing that matters: whether new security fixes are produced.
Key Dates at a Glance
- Oracle Identity and Access Management 14.1: Premier Support ends 2030-12-31; Extended Support ends 2033-12-31
- Oracle Identity and Access Management 12.2: Premier Support ends 2026-12-31; Extended Support ends 2027-12-31
What the December 2026 date covers
Oracle's document gives one row per product and names what each row includes in a footnote. The 12c and 14c rows share the same four footnotes, so the component lists below apply to both releases. Every date in the table is rewritten from our data at each build: "Premier Support ends" is our eol field for this product and "Extended Support ends" our extendedSupport field. Oracle's GA dates are months, so no release day is shown.
| Oracle row | What the footnote says it includes | Premier Support ends | Extended Support ends |
|---|---|---|---|
| Oracle Access Management 12.2.x | Access Manager, Access Manager WebGates, Identity Federation, Advanced Authentication Adaptive Risk Management, Radius Agent and Universal Authenticator | December 31, 2026 | December 31, 2027 |
| Oracle Identity Governance 12.2.x | Self Service, Access request, Workflow, Core Provisioning, Access Certification, Reports, Identity Audit/SOD engine, User/Role/Policy/Organization/Application Management, Connectors, Identity Role Intelligence | December 31, 2026 | December 31, 2027 |
| Oracle Unified Directory 12.2.x | Directory, Virtualization, Unified Directory Services Manager | December 31, 2026 | December 31, 2027 |
| Oracle Internet Directory 12.2.x | Directory, Directory Services Manager, Directory Integration Platform | December 31, 2026 | December 31, 2027 |
| All four products at 14.1.x (14c) | Same four footnotes | December 31, 2030 | December 31, 2033 |
Three things the table cannot show. First, the 12c identity dates are the same months as the Fusion Middleware 12c (12.2.x) row in the same document, so an estate that runs these products alongside WebLogic Server 12.2.1.x reaches both Premier dates on December 31, 2026; our Fusion Middleware 12c guide covers that side. Second, the dates are release-level. Which 12.2.1.x patch set receives fixes within them is governed by the Oracle Fusion Middleware Error Correction Policy, which the document points to for 12c error correction dates (My Oracle Support Doc ID 1933372.1, behind a support login). Third, Identity Manager connectors have their own end dates: the document refers readers to the Oracle Identity Manager Connectors Support Lifecycle (Doc ID 2454684.1).
Every earlier identity line is already in Sustaining Support. Oracle Identity Management 11gR2 (11.1.2.x) left Premier Support at the end of December 2020 and Extended Support at December 31, 2021; the 11gR1 and 10gR3 rows ended earlier still. All of them are on the product page.
Premier, Extended, Sustaining: what each stage includes, in Oracle's terms
The policy document defines the three stages on its printed pages 3 and 4. In short, with Oracle's wording quoted where the exact words matter:
Premier Support is the standard five-year stage from general availability. Its benefit list includes major product and technology releases, technical support, access to My Oracle Support, "Updates, fixes, security alerts, data fixes, and critical patch updates", upgrade scripts, and certification with most new third-party and Oracle products.
Extended Support provides "an extra three years of support for specific Oracle releases for an additional fee". Its benefit list repeats the Premier line on updates, fixes, security alerts, data fixes and critical patch updates; certification narrows to "most existing" third-party and Oracle products, and the document adds that Extended Support may not include certification with some new third-party products.
Sustaining Support is available "for as long as you license your Oracle products", whether Premier ended without Extended being bought or Extended has ended. It includes technical support, My Oracle Support access, and the fixes and critical patch updates "created during Premier Support and Extended Support". It does not include "New updates, fixes, security alerts, data fixes, and critical patch updates", new tax, legal and regulatory updates, new upgrade scripts, certification with new products, or the 24-hour response commitment for Severity 1 requests.
The exploitation record
CISA's Known Exploited Vulnerabilities catalog files this family's entries under vendor "Oracle" and product "Fusion Middleware", not under the identity product names, so a search for Identity Manager or Access Manager in the catalog's product column finds nothing. Read by description, Oracle Identity and Access Management has 2 entries, and CISA's known-ransomware-campaign-use flag is set on 0 of them. Both describe a full takeover by an unauthenticated attacker.
CVE-2025-61757 was added to the catalog on November 21, 2025 with a federal due date of December 12, 2025. CISA's description, verbatim: "Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager." Oracle's October 2025 Critical Patch Update advisory lists it against Identity Manager, component REST WebServices, remotely exploitable without authentication, with CVSS 3.1 base score 9.8 and supported versions affected 12.2.1.4.0 and 14.1.2.1.0.
CVE-2021-35587 was added on November 28, 2022 with a federal due date of December 19, 2022. CISA's description: "Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product." Oracle's January 2022 Critical Patch Update advisory lists it against Oracle Access Manager, component OpenSSO Agent, CVSS 3.1 base score 9.8, supported versions affected 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0.
Both fixes reached customers the same way: as a Critical Patch Update for a release still in Premier Support. That delivery mechanism is exactly what Sustaining Support excludes. If a third identity flaw of this kind is fixed in a 2027 Critical Patch Update, a 12.2.1.4.0 estate in Sustaining Support is not entitled to that new fix.
Where a 12c identity estate goes
Oracle Identity and Access Management 14c (14.1.2.1.0). Oracle's document lists the 14c rows for all four products with a GA of March 2025, Premier Support ending December 31, 2030 and Extended Support ending December 31, 2033. The upgrade has one fixed entry point. Oracle's Identity Manager upgrade guide says the only supported starting point for an upgrade to Oracle Identity Manager 14c (14.1.2.1.0) is the 12c (12.2.1.4.0) release, by in-place upgrade or out-of-place cloned upgrade. Oracle's Access Manager upgrade guide gives the same starting point and adds that an Access Manager on an earlier 12c release must upgrade to 12.2.1.4.0 before it moves to 14c. A 12.2.1.3.0 estate therefore has two upgrades ahead of it, not one.
Extended Support as a bridge. For an estate that cannot finish a 14c upgrade in 2026, Extended Support to December 31, 2027 keeps critical patch updates coming for one more year, at Oracle's additional fee and with the certification limits above. It is a year, not a plan: the same Sustaining Support stage begins in January 2028.
Third-party support. A commercial market exists for patching and break-fix on Oracle middleware after Oracle's support ends; what is covered varies by vendor and product, and that is what the form on this page matches. It does not restore Oracle's Critical Patch Updates; it replaces them with someone else's engineering.
Documented risk acceptance. If a 12c directory or identity server is isolated and scheduled for decommission, write that down, with dates. For an Access Manager or Identity Governance deployment reachable over HTTP, the two KEV entries above are the argument against it.
What to do
- Inventory by patch set, not just by release. Record the full version of every Access Manager, Identity Governance, Unified Directory and Internet Directory instance (12.2.1.4.0 or 12.2.1.3.0, say). The Premier date is the same for both; the 14c upgrade path is not.
- Check the October 2025 and January 2022 patches are applied. Both KEV entries list 12.2.1.4.0 as affected. A 12c identity tier that is behind on Critical Patch Updates is exposed now, before any support date.
- Decide Extended Support before January 2027. The first Critical Patch Update that falls under Extended Support terms is the January 2027 release. A contract signed after that buys a year that has already started.
- Plan the 14c upgrade from 12.2.1.4.0. Premier Support for 14c runs to December 31, 2030, which gives an upgrade finished in 2027 at least three years before the next decision.
- Watch the live page. The Oracle Identity and Access Management page carries every release with its Premier and Extended dates, checked against Oracle's document and refreshed at every build; a new edition of the policy shows up there first.
Frequently Asked Questions
When does Oracle Identity and Access Management 12c reach end of support?
Oracle publishes support stages, not an end-of-life date. Oracle's Fusion Middleware Lifetime Support Policy lists Oracle Access Management, Oracle Identity Governance, Oracle Unified Directory and Oracle Internet Directory 12.2.x with Premier Support ending December 2026, Extended Support ending December 2027 and Sustaining Support indefinite. Each stage runs through the last day of the month, so Premier Support ends on December 31, 2026 and Extended Support on December 31, 2027.
Does Oracle Identity Governance 12.2.1.4 still get security patches after Premier Support ends?
Only under Extended Support. Oracle's policy lists updates, fixes, security alerts, data fixes and critical patch updates among the benefits of Extended Support, which is sold for an additional fee; for the 12c identity products it runs to December 31, 2027. Without it the products move into Sustaining Support, which Oracle's policy says does not include new updates, fixes, security alerts, data fixes or critical patch updates. Which 12.2.1.x patch sets receive fixes is set separately by Oracle's Fusion Middleware Error Correction Policy.
What is the upgrade path from Oracle Identity and Access Management 12c?
Oracle Identity and Access Management 14c (14.1.2.1.0). Oracle's upgrade guides name 12c (12.2.1.4.0) as the only supported starting point for an Oracle Identity Manager upgrade and as the supported starting point for an Oracle Access Manager upgrade; an Access Manager estate on an earlier 12c release must first upgrade to 12.2.1.4.0. Oracle's policy lists the 14c identity products with Premier Support ending December 2030 and Extended Support ending December 2033, so December 31, 2030 and December 31, 2033 under the last-day-of-month rule.
Is Oracle Identity Manager in CISA's Known Exploited Vulnerabilities catalog?
Yes. CISA files the entries under vendor Oracle and product Fusion Middleware. Its description of CVE-2025-61757 says the flaw allows unauthenticated remote attackers to take over Identity Manager; its description of CVE-2021-35587 says an unauthenticated attacker with network access via HTTP can take over the Access Manager product. Oracle's October 2025 and January 2022 Critical Patch Update advisories list 12.2.1.4.0 among the affected supported versions.
Related
- Oracle Identity and Access Management · Oracle Identity and Access Management 12.2 · Oracle Identity and Access Management 14.1 — every release with its Premier and Extended Support dates
- Oracle Fusion Middleware 12c Premier Support — WebLogic, Forms, HTTP Server, SOA Suite and ADF on the same date
- The July 2026 Critical Patch Update and unsupported Oracle releases — what a CPU does and does not cover
- Oracle legacy middleware — the Sustaining Support pattern on older lines
- Exploited & Unpatchable — the feed of KEV entries on products past their fix window
- How we verify our dates — the rules every number on this site is held to