Ubuntu security updates: patch Ubuntu LTS releases fast

Updated November 2026

On a supported Ubuntu release, sudo apt update && sudo apt upgrade installs every published security fix, and Ubuntu Server already does this daily by itself. As of November 2026 the LTS releases with standard support are 26.04, 24.04 and 22.04; 20.04 and 18.04 get fixes only through Ubuntu Pro.

Supported releases

Ubuntu security maintenance as of November 2026 (dates from Canonical’s release cycle page)
ReleaseStandard security maintenanceExpanded Security Maintenance (Ubuntu Pro)Legacy add-on
26.10 “Stonking Stingray” (interim)Until July 2027––
26.04 LTS “Resolute Raccoon”Until May 2031Until May 2036Until May 2041
24.04 LTS “Noble Numbat”Until May 2029Until May 2034Until May 2039
22.04 LTS “Jammy Jellyfish”Until May 2027Until May 2032Until May 2037
20.04 LTSEnded May 2025Until May 2030Until May 2035
18.04 LTSEnded May 2023Until May 2028Until May 2033
16.04 LTSEnded April 2021Ended May 2026Until May 2031
14.04 LTSEnded April 2019Ended May 2024Until May 2029

Check the release:

lsb_release -a
cat /etc/os-release

Standard support covers the main repository. Packages in universe and multiverse get security fixes only through ESM in Ubuntu Pro, even on a current LTS release. Interim releases such as 26.10 are supported for a short time (26.10 until July 2027) and get no ESM, so servers normally run an LTS release.

Apply security updates now

sudo apt update
sudo apt upgrade

In scripts, use apt-get (for example sudo apt-get --quiet update), because the apt interface is meant for people and may change. To see the security picture of the whole machine, including which installed packages come from universe and whether ESM fixes are waiting:

pro security-status
pro security-status --esm-apps

Fix one CVE or USN

The Ubuntu Pro client (the pro command) can check and fix a single issue. Replace the identifier with the one you are chasing. Run the dry run first: it says whether the machine is affected and what it would install, and changes nothing.

sudo pro fix --dry-run CVE-YYYY-NNNNN
sudo pro fix CVE-YYYY-NNNNN
sudo pro fix USN-NNNN-N

Exit code 0 means fixed or not affected, 1 means the fix cannot be applied (for example, none is published yet, or it needs an ESM service that is not enabled), and 2 means the fix was applied but needs a reboot. pro cves --fixable lists CVEs on the machine that already have a fix.

Ubuntu Pro and ESM

Ubuntu Pro adds Expanded Security Maintenance: fixes for critical, high and selected medium vulnerabilities for 10 years per LTS release, covering the whole archive (esm-infra for main, esm-apps for universe). The Legacy add-on stretches this to 15 years. Canonical states that Pro is free for personal use on up to 5 physical machines (50 for official Ubuntu Community members). Other use needs a paid subscription.

sudo pro attach YOUR_TOKEN
pro status

Get the token from your Ubuntu Pro account at ubuntu.com/pro. On LTS releases, attaching also turns on Livepatch by default. pro status lists each service and whether it is on.

Automatic security updates

unattended-upgrades is installed and enabled by default on Ubuntu Server. Each day it refreshes the package lists and installs updates from the release, security and ESM security pockets only. Confirm it is on:

cat /etc/apt/apt.conf.d/20auto-upgrades
sudo unattended-upgrade -v --dry-run

The file should contain:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

If the package is missing, install it with sudo apt install unattended-upgrades. Logs are in /var/log/unattended-upgrades/. To reboot automatically when an update asks for it, set these in a file under /etc/apt/apt.conf.d/:

Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";

Reboots the server. With Automatic-Reboot on, the machine restarts at that time without confirmation, and by default even if users are logged in (Automatic-Reboot-WithUsers).

Restarts, reboots and Livepatch

After apt or unattended-upgrades installs updates, needrestart runs and, on Ubuntu Server, restarts affected services automatically by default. Services on its exclusion list are never restarted, so check its output. To see whether a reboot is needed and which packages asked for it:

pro system reboot-required
cat /var/run/reboot-required.pkgs

Kernel fixes take effect after a reboot (sudo reboot restarts the server). Canonical Livepatch, part of Ubuntu Pro, applies high and critical kernel fixes to the running kernel without a reboot:

sudo pro enable livepatch
sudo canonical-livepatch status --verbose

Livepatch only works on supported kernels and is not compatible with the FIPS or real-time kernels. It covers the gap between maintenance windows; you still need to boot new kernels regularly. With Livepatch active, the client may remove the reboot notice after a kernel update when Livepatch already covers the new kernel’s fixes. Monitoring that relies on /var/run/reboot-required then stays quiet, and Automatic-Reboot does not fire. See Kernel live patching and Kernel updates.

Where Ubuntu publishes advisories

Upgrading to a newer LTS

When standard support ends, either attach Ubuntu Pro (free for up to 5 personal machines) to keep getting ESM fixes, or upgrade. Upgrades go one LTS at a time: 20.04 to 22.04, then 22.04 to 24.04, then 24.04 to 26.04. You cannot skip a release. LTS-to-LTS upgrades are offered only after the first point release; 26.04.1 is out, so 24.04 servers can now move to 26.04.

sudo apt update
sudo apt dist-upgrade -o APT::Get::Always-Include-Phased-Updates=true
do-release-upgrade -c          # only checks whether a new release is available
sudo do-release-upgrade        # restarts services and asks to reboot at the end

Back up data first, and read the release notes for the target release. Do not use -d on production servers: it upgrades to a development release. For planning around end-of-life dates, see Is my OS supported?.

Sources