generated: '2026-08-27'
method: searched
source: https://www.oracle.com/corporate/security-practices/assurance/vulnerability/
provider: Oracle Partitioning
providerId: oracle-partitioning
description: >-
  Oracle operates a published vulnerability handling and disclosure program covering all Oracle
  products, which includes the Oracle Database Partitioning option.
program:
  published: true
  name: 'Oracle Vulnerability Handling and Disclosure'
  url: https://www.oracle.com/corporate/security-practices/assurance/vulnerability/
  probed: { url: 'https://www.oracle.com/corporate/security-practices/assurance/vulnerability/', status: 200 }
  security_practices_hub: https://www.oracle.com/corporate/security-practices/
  advisories:
    url: https://www.oracle.com/security-alerts/
    cadence: 'quarterly Critical Patch Update, plus out-of-cycle Security Alerts'
    probed: { url: 'https://www.oracle.com/security-alerts/', status: 200 }
  cvss: true
  cve: true
bug_bounty:
  present: false
  note: 'No HackerOne, Bugcrowd or Intigriti program was found for Oracle.'
security_txt:
  present: false
  note: >-
    No /.well-known/security.txt is served. www.oracle.com returns 403 on every /.well-known/* path
    and docs.oracle.com returns 404. See well-known/oracle-partitioning-well-known.yml. This is a
    real gap: a large vendor with a mature disclosure program publishes no RFC 9116 pointer to it.