You can upgrade or apply patches to the Oracle database while Database Vault is enabled by granting a special role to SYS. As a user with the DV_OWNER role, grant DV_PATCH_ADMIN to SYS for all pluggable databases.

From the container database:

1. Connect as a user with the DV_OWNER role:

   connect c##dvowner

2. Grant DV_PATCH_ADMIN to SYS for all pluggable databases:

   GRANT DV_PATCH_ADMIN TO SYS CONTAINER=ALL;

3. Once patching is complete, revoke DV_PATCH_ADMIN from the SYS user:
   1. Connect as a user with the DV_OWNER role:

      connect c##dvowner

   2. Revoke DV_PATCH_ADMIN:

      REVOKE DV_PATCH_ADMIN FROM SYS CONTAINER=ALL;