Back to Blogs

Oracle Hyperion Patching: Frequency and How to Apply on Windows and Linux

By Lead Innovative Technologies|10 min read|Oracle Hyperion

On-premises Oracle Hyperion (Oracle Enterprise Performance Management System 11.2) does not patch itself the way Cloud EPM does. Every quarter, someone on your infrastructure team has to download the release update, take backups, stop services, run the patch, and bring everything back up. This guide explains how often that happens, which upgrade path applies to you, and exactly how to apply the patch on Windows and Linux.

Commands and steps below are based on Oracle's official Release 11.2.27 Readme, published October 22, 2026, and the EPM System Installation and Configuration Guide. Always read the readme for the specific release you are applying, since prerequisites change from release to release.

How Often Oracle Releases Hyperion Patches

Oracle releases EPM System 11.2 updates on a quarterly basis, generally in January, April, July, and October. Each one is a Quarterly Release Update delivered as a single OPatch bundle that contains individual OPatches for every EPM component: Foundation Services, Financial Management, Planning, Calculation Manager, FDMEE, Financial Reporting, Profitability and Cost Management, Financial Close Management, and so on.

Key characteristics, straight from Oracle's update policy:

  • Cumulative. Release 11.2.27 includes every update since 11.2.15, so you do not need to apply each quarter in sequence.
  • In place. Updates are applied to your existing installation, not as a new install.
  • Includes embedded components. Java, WebLogic, ADF, Oracle HTTP Server, and Essbase patches are bundled as needed. 11.2.27 ships Java 8 Update 501, Essbase 21.8.3, and WebLogic Patch Set Update 12.2.1.4.260703.
  • Absorbs one-off fixes. Any customer-specific patches Oracle released during the quarter are rolled into the next update.

Recent cadence: 11.2.26 shipped July 30, 2026 and 11.2.27 on October 22, 2026. Following the quarterly pattern, the next update (11.2.28) is expected around January 2027.

How often should you patch? Oracle only fixes issues on the current code line, and embedded Java and WebLogic patches carry security fixes. A practical target is to apply each quarterly update within one quarter of release: Test or Dev first, then Production after a validation cycle. Teams that skip several quarters lose security fixes and end up with larger, riskier jumps.

Find Your Upgrade Path First

The quarterly update can only be applied directly on top of Release 11.2.15 or later. If you are older than that, you need intermediate steps:

  • On 11.2.15 or later: apply 11.2.27 directly with the ApplyUpdate script.
  • On 11.2.8 to 11.2.14: apply an update to 11.2.12, 11.2.13, or 11.2.14 (if needed), install the update to 11.2.15 using the EPM System Installer's Apply Update option, then apply 11.2.27.
  • Earlier than 11.2.8: install the update to 11.2.8 first, then follow the path above.
  • On 11.1.2.x: upgrade to 11.2.8 first, then follow the same path.

Check your current version in Workspace under Help → About → Show Details, or with the OPatch inventory commands in the Verify section below.

Before You Patch: Prerequisites Checklist

These apply to both Windows and Linux:

  1. Download the update from Oracle Software Delivery Cloud (edelivery.oracle.com) for your platform. Unzip into a folder with no spaces in the path, using a tool that handles long path names such as 7-Zip. Do not add any extra OPatch ZIP files to the extracted update folder.
  2. Disable anti-virus on every EPM server and keep it disabled for the whole update.
  3. Check for patch conflicts with the -verify option (commands below).
  4. Back up the EPM Oracle Home (default MIDDLEWARE_HOME/EPMSystem11R1) and the EPM Oracle Instance (default MIDDLEWARE_HOME/user_projects/epmsystem1). Take database backups of your EPM schemas and a VM snapshot if you can.
  5. Back up the keystores (cacerts). Every update replaces the JDK folders, so any certificates you imported (for example for SSL-enabled LDAP or Active Directory) are lost unless you restore them afterward. On SSL-enabled Essbase, also back up MIDDLEWARE_HOME/essbase/bin/tls_tools.properties.
  6. Back up Essbase ODBC configuration if Essbase uses SQL Server. Essbase 21.8.x moves to DataDirect ODBC 8.0.2 drivers, and configuration must be updated by hand.
  7. Stop all services: EPM System services, Node Manager, Oracle HTTP Server (if used), the WebLogic Administration Server, and Essbase.

How to Apply the Patch on Windows

1. Stop services

Run the stop script from the EPM instance, then confirm the Node Manager, OHS, and WebLogic Administration Server Windows services are stopped:

cd D:\Oracle\Middleware\user_projects\epmsystem1\bin
stop.bat

2. Back up keystores

copy D:\Oracle\Middleware\jdk\jre\lib\security\cacerts D:\backup\cacerts_jdk
copy D:\Oracle\Middleware\EPMSystem11R1\common\JRE\Sun\1.8.0\lib\security\cacerts D:\backup\cacerts_epm

3. Check for conflicts

Open Windows PowerShell as Administrator (the script must run with administrator privileges) and go to the extracted update folder:

cd D:\Downloads\11.2.27.0-Update-Win
.\ApplyUpdate.ps1 D:\Oracle\Middleware -verify

4. Apply the update

.\ApplyUpdate.ps1 D:\Oracle\Middleware

Replace D:\Oracle\Middleware with your own MIDDLEWARE_HOME. Run the script on each server in the deployment where EPM components are installed.

5. Essbase ODBC (SQL Server only)

On the Essbase host, export HKLM\SOFTWARE\ODBC\ODBC.INI and ODBCINST.INIfrom Registry Editor as backups. Then update each Essbase data source's Driver and Description from Oracle 7.1 SQL Server Wire Protocol to Oracle 8.0 SQL Server Wire Protocol. Finally, edit ODBC802.reg under ESSBASE_PRODUCT_HOME\modules\oracle.essbase.datadirect.odbc\8.0.2, replacing $ODBC_PATH with the absolute driver path, and double-click it to import.

How to Apply the Patch on Linux

1. Stop services

cd /u01/Oracle/Middleware/user_projects/epmsystem1/bin
./stop.sh

Also stop OHS, Node Manager, the WebLogic Administration Server, and Essbase if they are running separately.

2. Check /tmp and back up keystores

Redirecting the temp directory is not supported during Apply Update. Make sure /tmp has enough free space and the right permissions, and that it is not mounted with noexec:

df -h /tmp
mount | grep /tmp        # remove noexec if present before patching
cp /u01/Oracle/Middleware/jdk/jre/lib/security/cacerts /backup/cacerts_jdk
cp /u01/Oracle/Middleware/EPMSystem11R1/common/JRE/Sun/1.8.0/lib/security/cacerts /backup/cacerts_epm

3. Check for conflicts and apply

cd /u01/download/11.2.27.0-Update-Linux
./ApplyUpdate.sh /u01/Oracle/Middleware -verify
./ApplyUpdate.sh /u01/Oracle/Middleware

4. Essbase ODBC (SQL Server only)

Back up odbc.ini (under <Domain Root>/<Domain Name>/config/fmwconfig/essconfig/core) and the 7.1.6 odbcinst.ini. Then point each driver entry in odbc.ini to the 8.0.2 libraries, for example:

# From
Driver=<Oracle_HOME>/essbase/modules/oracle.essbase.datadirect.odbc/7.1.6/lib/ARsqls27.so
# To
Driver=<Oracle_HOME>/essbase/modules/oracle.essbase.datadirect.odbc/8.0.2/lib/ARsqls28.so

Make the same change for the DB2 (ARdb2) and MySQL (ARmysql) drivers if you use them, and update the 8.0.2 odbcinst.ini.

After the Patch: Configure and Validate

  1. Restore keystores by re-importing your certificates into the new JDK cacerts, then restart services:
    keytool -import -alias <alias_name> -keystore <path_to_cacerts> -file <certificate_file> -storepass <keystore_password> -trustcacerts
  2. Redeploy Foundation Services, Profitability and Cost Management, and Data Management (FDMEE). Start the WebLogic Administration Server on the Foundation host and run EPM System Configurator (configtool.bat or configtool.sh in EPM_ORACLE_HOME/common/config/11.1.2.0). Select only products you configured before.
  3. Configure the web server last, after every other host is configured, with “Set the logical address for the applications to this web server” selected. Hosts must be configured one at a time, not in parallel.
  4. HFM schema upgrade. 11.2.27 adds journal report fields, so run the schema upgrade tool (ofmssu) from one Financial Management server, in EPM_ORACLE_HOME/products/FinancialManagement/Server.
  5. Re-enable anti-virus, start all services, and smoke test: log in to Workspace, open a Planning form and an HFM application, run an FDMEE load, refresh Smart View, and run a Financial Report.

Verify the Patch Was Applied

Check the logs in EPM_ORACLE_HOME/diagnostics/logs/install/. ApplyUpdateSummary.log shows the status of each product OPatch, and ApplyUpdateDetail-<timestamp>.log has full OPatch output. Then list the inventory from MIDDLEWARE_HOME/EPMSystem11R1/OPatch:

# Windows
opatch lsinventory -oh D:\Oracle\Middleware\EPMSystem11R1 | findstr /i /L /c:"Patch"

# Linux
./opatch lsinventory -oh /u01/Oracle/Middleware/EPMSystem11R1 | grep "Patch[ ][ ]"

Run the same command against MIDDLEWARE_HOME (from MIDDLEWARE_HOME/OPatch) to confirm the WebLogic and other Fusion Middleware patches.

Rolling Back if Something Goes Wrong

The update includes a rollback script, run from the same extracted folder:

# Windows (PowerShell as Administrator)
.\RollbackUpdate.ps1 D:\Oracle\Middleware

# Linux
./RollbackUpdate.sh /u01/Oracle/Middleware

Important: rollback does not reverse the JDK, WebLogic CPU, OHS, Oracle Virtual Directory, Fusion Middleware (ADF and EM), ODBC, Shared Services, or Infrastructure OPatches. That is why the folder and database backups taken before patching are your real rollback plan. After a rollback, redeploy Foundation Services, Profitability and Cost Management, and FDMEE, and restore the Essbase ODBC settings from your backups.

Known Issues Worth Planning For in 11.2.27

  • External user directories. Jumping from a release earlier than 11.2.26 straight to 11.2.27 can break LDAP or Active Directory connections because of a new encryption algorithm. Re-enter each external provider's password in the Shared Services Console and restart.
  • HPCM Detailed applications are no longer supported from 11.2.27 and will not be accessible after the upgrade. Migrate them before you patch.
  • OHS log purging. OHS may delete rotated access and admin logs on startup. Set the retention value to 0 in httpd.conf and admin.conf if you keep those logs for auditing.

Build Patching Into a Quarterly Routine

The teams that patch Hyperion smoothly treat it as a calendar event, not a project: read the readme the week it is published, patch Dev or Test within a few weeks, run a standard regression checklist, and promote to Production with the same runbook. Keeping that rhythm means every update is a small step, and you are never stuck with a multi-release jump or an unsupported version when an audit or security review comes around.

If you want a partner to run that cycle for you, from readme review and patch application to validation across HFM, Planning, Essbase, and FDMEE, our Hyperion On-Premise Infrastructure team does exactly this. For the release-by-release detail, see our breakdown of Release 11.2.26.

Planning your move to 11.2.27, or still on 11.1.2.x and need an upgrade path? Lead Innovative Technologies can plan and apply the patch with your team, on Windows or Linux.