ERP Roundup: UCLA Settles With Oracle Over a System That Allegedly Did Not Meet Its Requirements
A settlement closing an eight-year ERP programme, a patch day where the workaround costs you a business process, a catalogue that renames itself this morning, and update notices with a March deadline. Four stories from the past seven days, none of them a defect anybody could have found in a test cycle.
1. UCLA and Oracle settle the Ascend dispute
The Register reported on 12 October that UCLA and Oracle have settled their dispute over Ascend, the finance and research administration programme first contracted in November 2017. UCLA pays $350,000 of $1.66m in outstanding invoices, Oracle waives the remaining $1.31m and credits $3.1m against future fees to May 2028, and neither party admits liability.
The timeline matters more than the money: started April 2018, originally due July 2020, Financials go-live paused in August 2024, a revised January 2025 date never met, a termination email in June 2025. The allegations recorded in the settlement are UCLA's and contested — that the services "did not perform as warranted" and "lacked sufficient functionality to meet the University's requirements", the document describing shortcomings in grants management. The Register says it asked Oracle to comment.
What it means for testing
Note what is alleged: not that the system broke, but that it never did what it was bought to do — still argued six years after kick-off. A fit gap that size belonged in 2019 and got carried as a configuration question instead. The dull defence works: every contracted requirement gets a numbered acceptance scenario, run against the actual product, with a named business owner who signs that it passed or records in writing that it did not. That record is the only account that survives a dispute. Birmingham made the same point from the other direction: the evidence you never created is the evidence nobody can produce later.
2. SAP patch day: the workaround that stops a process
SAP's October patch day fell on 13 October: SecurityBridge counts 21 notes, three of them HotNews. Note 3805589 (CVE-2026-89107, CVSS 9.9) is a code injection in S/4HANA's Manage Substitution/Validation Rules, where input from a user with a particular Fiori role runs as ABAP. Note 3797111 (CVE-2026-89110, 9.9) is broken access control in NetWeaver Visual Composer; Onapsis notes the setting restricting permitted data services ships off by default and the patch turns it on. Note 3798788 (CVE-2026-89108, 9.1) is a missing authorization check in SAP Manufacturing Integration and Intelligence.
Two details outrank the scores. The workaround for 3805589 is to deactivate the affected OData service, which per Onapsis blocks adding, changing or deleting substitution and validation rules — less a mitigation than a business process going dark until you patch. And Onapsis describes note 3626303 (CVE-2026-89120, 7.1, ABAP Platform) as a missing authorization check reintroduced by an API change: a control that was there, then was not, because something adjacent moved.
What it means for testing
If you take a workaround, the workaround is the test scope. Someone must establish which teams cannot do their job while that service is off, and for how long — a business question answered by business users, which is an acceptance cycle convened at speed. And the reintroduced authorization check is the argument for keeping permission assertions in the regression suite: controls do not stay fixed because a ticket was closed.
3. Copilot offers get renamed today: stop matching on names
An announcement in Microsoft's October Partner Center notices, dated 14 October, sets out two steps. From 16 October — today — every Copilot offer requiring a base subscription gains "(add-on)" in its name. From 1 December, new Copilot and Copilot Business offers can be bought without a base subscription, carrying new product and SKU IDs at the same price, and the add-on offers reach end of sale in CSP that day. Microsoft's own instruction is the quotable part: update scripts, catalogue mappings and automations to use product and SKU IDs rather than names — an admission that plenty of them do not.
What it means for testing
This is the defect class no acceptance script catches, because nothing in your code changed: a string you matched on changed underneath it. Anywhere a licence name is compared, parsed or reported — provisioning automation, billing reconciliation, a client usage report, a spreadsheet with a VLOOKUP — is worth a grep rather than a test case. Put it on the pre-go-live list beside tenant settings and licence keys, as we argued about the Copilot spending cap last Friday. Commercial metadata is an integration dependency nobody wrote an interface spec for.
4. BC29 update notices land, and the clock is your regression budget
Yun Zhu posted on 13 October that the Business Central 29.0 major update is reaching existing customers, relaying notification emails that name a scheduled date per environment and state the update must run before 1 March 2027, with dates differing by region. Zhu is an MVP relaying Microsoft's mail, so read your own admin centre for the date that binds you.
The mechanic is worth getting right, because the trade press muddled it. Retiring the release wave announcement model did not make Business Central's shipping cadence continuous. The update rollout timeline still describes two major releases a year, April and October: a five-month update period from GA you can reschedule inside, a one-month grace period every March in which you cannot, then an enforced update period where extensions that cause the update to fail "might be automatically uninstalled from the environment so that the update succeeds". Data survives and a compatible version can be reinstalled.
What it means for testing
Five months sounds generous until you divide it across a client list. The deliverable is a sandbox rehearsal per tenant answering one question — does any extension here fail the update — because the enforced path answers it by uninstalling that extension in production. Book rehearsals against the dates in each admin centre, not a generic March, and scope each pass from what the upgrade touches rather than what the user sees.
The through-line: four decisions taken outside the test environment
A contract argued over functionality nobody scripted a scenario for. A workaround that removes a business capability. A catalogue that renames itself overnight. An update calendar that will act on your behalf in March. None is a bug and none appears on a screen to click; each arrives as a decision already taken, and the only question is whether anyone knew in time. Monday's post asked who is writing the test cases now; this is the limit of that answer. A generated suite covers the scope it was given, and all four of this week's stories sit outside it. What catches them is not a better script but a named owner, a recorded answer and a date.
Free ERP UAT checklist (Excel)
A structured workbook covering the full UAT cycle: pre-UAT preparation tasks, test execution tracking, an issue log with severity guide, and post-UAT wrap-up. Built from real ERP implementations.
No spam. We will occasionally send UAT and ERP implementation resources. Unsubscribe any time.
Sources and further reading
- The Register, Lindsay Clark: UCLA settles Oracle ERP dispute with $3.1m in credits and $1.31m wiped off the bill, with the Ascend timeline and the allegations recorded in the settlement (12 October 2026)
- SecurityBridge: SAP Security Patch Day, October 2026 — 21 notes in total and the three HotNews notes with CVE and CVSS detail (13 October 2026)
- Onapsis: SAP Security Patch Day for October 2026, including the workaround consequences for note 3805589 and the reintroduced authorization check in note 3626303 (13 October 2026, updated 15 October)
- Microsoft Partner Center: October 2026 announcements, including the Copilot offer name and SKU changes of 16 October and 1 December (announced 14 October 2026) and the republished October CSP price list (15 October 2026)
- Yun Zhu (Microsoft MVP): Major update of Business Central 2026 release wave 2 (BC29) is available for existing customers, relaying the scheduled-update notification emails (13 October 2026)
- Microsoft Learn: Update rollout timeline, describing the five-month update period, the March grace period and the enforced update period in which failing extensions might be automatically uninstalled
The Requirement Nobody Scripted Is The One In The Settlement
LogicHive gives ERP implementation teams the acceptance layer automated tests do not cover: structured test cases tied to requirements, named business owners, linked defect tracking, and sign-off built from real execution data rather than a screenshot of a passing build. When a vendor dispute, a security workaround or an enforced update arrives, the record of who accepted what, and when, is already there. The free plan runs a real project end to end.
Written by Sharif George
LogicHive Frontman
Sharif is the frontman for LogicHive. He writes the ERP news roundups and the Business Central release coverage, following each Microsoft, SAP and Oracle change through to what it means for regression scope and acceptance testing on live implementation projects.
View all articles by Sharif GeorgeRelated reading
ERP & Enterprise
AI Writes the Test Cases Now. The Survey Behind This Week's Headline Says Less Than the Headline Did.
Applause's functional testing survey reached the UK trade press this week under the headline that AI use has surged and defects are rising. Its own data table is messier: more respondents reported defects falling on both number and severity (26.4%) than reported both rising (14.7%), and 19.8% do not track it at all. Meanwhile the single most common use of AI in testing is writing the test cases. On an ERP project the scripts are the acceptance scope, so that is a change in who authored it.
12 October 2026 · 6 min read
ERP & Enterprise
ERP Roundup: Business Central 26 Goes Out of Support on Monday, and SAP Puts a Risk Tier on Every Agent
Business Central 26 stops being serviced on 13 October and 26.18 is its last cumulative update, while BC29 on-premises download packages appeared the same week. SAP Connect named three levels of agent oversight and gave every agent an owner and a risk tier, and Copilot Business default-on billing slipped to 1 December with a 4,000-credit cap. No named ERP failure or lawsuit surfaced, so three stories and what each changes about testing.
9 October 2026 · 6 min read
ERP & Enterprise
Business Central's Record-and-Replay Test Tool Reached GA This Week. It Is Not UAT.
Microsoft moved the Business Central page scripting tool from preview to general availability with version 29, thirty months after the preview opened, adding multi-row grid selection and dialog-text validation — neither of which the reference documentation describes yet. What a recording actually proves, what it is documented not to reach, and why a replay pipeline is a regression asset rather than an acceptance one.
5 October 2026 · 6 min read