With the upcoming on-premise release of Oracle Database 188.8.131.52, Oracle has updated the Critical Patch Update (CPU) security patch end dates for 184.108.40.206 and 220.127.116.11. Currently (as of January 2017), only 18.104.22.168 and 22.214.171.124 are supported for CPUs.
The CPU end-dates, which correspond with the end of Extended Support, have been extended to October 2020 for 126.96.36.199 and July 2021 for 188.8.131.52. The first year of extended support for both versions is free until December 2018 for 184.108.40.206 and July 2019 for 220.127.116.11.
All Oracle databases should be updated to either 18.104.22.168 or 22.214.171.124, which provides at least three years of CPU support. To ensure database security and minimize Oracle support costs, organizations should plan to upgrade 126.96.36.199 and 188.8.131.52 databases in 2018 and move to 12.2 at that time. All new databases should be 184.108.40.206 and look to begin production use of 12.2 in late 2017 or with the release of 220.127.116.11 in eary 2018.
For databases that are not currently upgraded to 18.104.22.168 or 22.214.171.124, you must mitigate the risk of not applying security patches as there are at least 27 moderate to high risk unpatched security vulnerabilities in unsupported versions. A number of these vulnerabilities allow any user, even with only CREATE SESSION, to compromise the entire database. At a minimum, you must harden the database, limit network access as much as possible, review access and privileges, and enable auditing and monitoring in order to potentially identify attacks and compromises.
See MOS Support Note 742060.1 for more information on Oracle Database version support.