TrueNAS: keeping your NAS updated and safe

Updated November 2026

Keep TrueNAS on the release its makers recommend for general use, which as of November 2026 is TrueNAS 25.10.7, and install updates from the Update screen in the web interface. TrueNAS CORE (the FreeBSD-based line, 13.x) no longer gets updates. Never put the web interface or SMB shares on the internet, and schedule snapshots so ransomware cannot destroy your only copy.

Editions and supported releases

TrueNAS is now offered as TrueNAS Community Edition (free) and TrueNAS Enterprise (the commercial edition with vendor support). Both are Linux-based; this line was earlier called TrueNAS SCALE, and the name still appears in download paths and documentation URLs. The old FreeBSD-based TrueNAS CORE is a separate, retired line.

From version 26, TrueNAS moved to one major release a year and to plain version numbers instead of fish code names. The release in testing as TrueNAS 26 was then renamed TrueNAS 27, starting with 27-RC.1.

TrueNAS release status as of November 2026 (TrueNAS software status page)
ReleaseLatest versionStatus
25.10 “Goldeye”25.10.7 (September 2, 2026)Recommended for general and mission-critical use
27 (formerly 26)27-RC.1 (October 6, 2026)Release candidate, for early adopters only
25.04 “Fangtooth”25.04.2.6 (October 30, 2025)No longer recommended; move to 25.10
24.10, 24.04–No longer receiving updates
CORE 13.0, 13.313.0-U6.8, 13.3-U1.2No longer under active development

The installed version is shown on the Update screen. Check the status page before every major move; the recommendations change several times a year.

Update profiles (the old “trains”)

Older TrueNAS versions let you choose an update “train”, such as a release name. Current versions use update profiles instead: you pick how much risk you accept, and TrueNAS offers the matching version. The status page lists four:

Mission Critical
The default for Enterprise systems. The most conservative choice.
General
The right choice for most Community Edition users. Currently 25.10.7.
Early Adopter
Release candidates and new major versions. Currently 27-RC.1.
Developer
Nightly builds in active development. Expect bugs; never use it on a NAS that holds real data.

If you only need security and bug fixes, stay on General and let it carry you forward when a new major version is judged ready.

How to update in the web UI

  1. Open the Update screen (under System Settings). If an update exists it appears under Update Available.
  2. Click Install Update. When asked to save the configuration, tick Export Password Secret Seed and click Save Configuration. Store the file somewhere safe and private: it contains the secrets needed to restore the system.
  3. TrueNAS downloads and installs the update, then restarts the system. Shares and apps are unavailable during the restart, so pick a quiet time.
  4. After the restart, clear the browser cache (Ctrl+F5) before logging in again.

If the NAS cannot reach the update server, download the update file from the TrueNAS website, click Install next to Manual Update, choose the file and click Apply Update. The system restarts automatically when it finishes.

Major versions. TrueNAS says to update to the latest maintenance release of your current major version before moving to the next major version. For example, go to 25.10.7 first, and only then to 27 once it is a full release on the General profile.

TrueNAS CORE is end of life

End of life means no more fixes. The software status page says TrueNAS CORE “is no longer under active development”, and TrueNAS stated in February 2026 that 13.0 is no longer receiving updates. A NAS still on CORE gets no new security fixes, even though it keeps working.

Until you migrate, keep the CORE box away from untrusted networks. See Is my OS supported?.

Keep apps updated

TrueNAS apps run as containers, and each one has its own update stream separate from the system. Catalog apps do not update themselves:

Remove apps you no longer use. An app published to the internet (a media server, a file-sync app) is the most likely way in, so update those first. See Containers.

Do not expose the NAS

TrueNAS's own security recommendations say to restrict the web UI, IPMI (the server board's remote management port) and other management interfaces to private subnets, and to route remote access through a VPN. In practice:

Snapshots against ransomware

ZFS snapshots are read-only, point-in-time copies of a dataset. If ransomware on a PC encrypts files on an SMB share, the snapshot still holds the clean versions, and you can roll back or copy files out of it.

Create a schedule under Data Protection → Periodic Snapshot Tasks → Add. Pick the dataset, how long to keep snapshots (lifetime) and the schedule. A common pattern is hourly snapshots kept for two days plus daily snapshots kept for four weeks.

Snapshots are not a backup. They live on the same pool, and anyone with admin access to the NAS can delete them. Replicate snapshots to a second system, keep at least one copy offline or with separate credentials, and test restores. See Ransomware-proof backups and, if files are already encrypted, Ransomware.

Security advisories

The TrueNAS Security Team publishes advisories at security.truenas.com. Open the product card (TrueNAS Community/Enterprise, or TrueNAS CORE/Enterprise for the old line) to see the latest advisories, or search by CVE or by your TrueNAS version. More on tracking feeds: Security advisories.

Sources