What Oracle announced
From the OCI service change announcements (dated 6 October 2026):
| Item | Date |
|---|---|
| New external-customer onboarding restricted | 10 October 2026 |
| Contact Oracle (amw-generic_ww@oracle.com) about your usage | by 30 October 2026 |
| Final public end of life | To be confirmed, no earlier than 31 December 2026 |
Oracle's advice: don't create new dependencies on ADM, plan to migrate or stop using it, and export any information you need to keep before the final date.
Earlier in 2026 (10 February) Oracle had already removed cvssV2Score, cvssV3Score and isFoundInKnowledgeBase from the ListApplicationDependencyVulnerabilities API. Scripts that still read those fields are already getting empty values.
1. Find where ADM is used
# knowledge bases per compartment
oci adm knowledge-base list --compartment-id $C --all \
--query "data.items[].{name:\"display-name\", id:id, state:\"lifecycle-state\"}" --output table
# vulnerability audits
oci adm vulnerability-audit list --compartment-id $C --all \
--query "data.items[].{name:\"display-name\", kb:\"knowledge-base-id\", created:\"time-created\"}" --output table
# remediation recipes (automated fix pull requests)
oci adm remediation-recipe list --compartment-id $C --all --output table
Repeat for each compartment (or loop over oci iam compartment list --all --compartment-id-in-subtree true). Then search your DevOps build specs and CI configs for the ADM build stage or oci adm calls:
grep -rn -E "adm |vulnerability-audit|VulnerabilityAudit" build_spec.yaml .github/ ci/ 2>/dev/null
Command group names follow the current OCI CLI; check oci adm --help on your version.
2. Export what you need
For audit or compliance evidence, export the audit results before the service goes:
for id in $(oci adm vulnerability-audit list --compartment-id $C --all --query "data.items[].id" --raw-output | jq -r '.[]'); do
oci adm vulnerability-audit get --vulnerability-audit-id "$id" > "audit-$id.json"
oci adm application-dependency-vulnerability list --vulnerability-audit-id "$id" --all > "deps-$id.json"
done
Store the files in an Object Storage bucket with a retention rule that matches your evidence policy.
3. Replace the capability
ADM did three things. Replace each one:
| ADM feature | Replacement idea |
|---|---|
| Vulnerability audit of Java/Maven dependencies in builds | A software composition analysis (SCA) step in the pipeline: OWASP Dependency-Check, Trivy, Grype or your organisation's commercial tool |
| Failing the build above a CVSS threshold | The same tool's exit code / policy (for example --fail-on high) |
| Remediation recipes (automatic upgrade pull requests) | Dependabot or Renovate in the code repository |
Example build step for an OCI DevOps build spec:
steps:
- type: Command
name: "Dependency scan"
command: |
curl -sSfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
trivy fs --scanners vuln --severity HIGH,CRITICAL --exit-code 1 .
Pin the scanner version in real pipelines rather than installing the latest at build time.
4. Clean up
Once pipelines no longer call ADM, delete knowledge bases, audits and recipes you've exported, remove ADM IAM policies, and remove the ADM build stage so nothing fails when the API disappears.
Checklist
- ADM resources listed in every compartment
- Pipelines and scripts that call ADM identified
- Oracle contacted by 30 October 2026 if you depend on ADM
- Audit results exported to retained storage
- Replacement SCA step and dependency-update bot in place
- ADM resources, policies and build stages removed