HP-UX 11i v3: patching after end of support

Updated November 2026

HPE ended Standard Support for HP-UX 11i v3 on December 31, 2025. Mature Support runs through at least December 31, 2028, but it includes no new fixes or security updates. Any vulnerability found from 2026 on stays unpatched, so install the last patches HPE released, cut the server's network exposure, and plan the move off HP-UX.

Support status

HPE announced the end dates in March 2020 and confirmed them in a Product Change Notification in October 2024. As of November 2026:

HP-UX 11i v3 and HPE Integrity support (as of November 2026)
Item	End date	What it means
HP-UX 11i v3 license sales	October 31, 2025	No new licenses
Integrity i4/i6 server sales	October 31, 2025	No new hardware (sold while stocks lasted)
HP-UX Standard Support	December 31, 2025	Last date for engineering support and new defect fixes
HP-UX Mature Support	At least December 31, 2028	No new fixes or security updates; access to existing fixes and updates
Integrity i4/i6 Mature Support	Ask HPE Services	Depends on available spare parts

No more security fixes. HP-UX 11i v3 is end of life for security purposes. Treat every HP-UX server as permanently vulnerable to any flaw published after 2025, in the OS and in the software that ships with it.

Check what you have

uname -r
swlist HPUX*OE*
swlist -l product

uname -r prints B.11.31 on HP-UX 11i v3. swlist HPUX*OE* shows the operating environment and its update; in a version such as B.11.23.0409, the last four digits are the year and month of the operating environment update. swlist -l product lists installed products, including patches. Write this down for every server: you need it for the patch work below and for the migration plan.

Install the last available patches

Customers with HPE Mature Support keep access to existing patches and releases through the HPE Support Center. If you already use HPE's free HP-UX Software Assistant (SWA), run it once more to list the patches and security fixes a system is missing.

Before you start, take a full recovery backup of the system. Then, as root, list the bundles in the patch depot you downloaded and install them:

swlist -d @ /tmp/patches/depot
swinstall -s /tmp/patches/depot -x autoreboot=true -x patch_match_target=true

This may reboot the server. With autoreboot=true, the system restarts automatically if a patch needs it; HP's guide warns that installing the quality pack (QPK) or hardware enablement (HWE) bundles always reboots. patch_match_target=true selects only patches that apply to software installed on this system. Afterwards, check the result:

swlist -l product
swverify PHxx_nnnnn

Replace PHxx_nnnnn with each patch ID you installed. Once every server has the last patches, this part of the job is finished for good: there will be nothing newer to install.

Open-source software on HP-UX. Components such as the SSH server, OpenSSL and web servers also stop getting HPE updates. Building newer versions yourself is possible but is not supported by HPE; you take on all testing and future fixes.

Reduce the exposure

If you cannot migrate yet, make each HP-UX server as hard to reach as possible:

Remove any direct internet access, inbound and outbound. Put HP-UX servers in their own network segment behind a firewall.
Allow only the ports and client addresses the application needs. Block everything else, including from your own office network.
Reach the servers for administration only through a jump host that uses multi-factor authentication.
List listening services with netstat -an | grep LISTEN and turn off what you do not use, especially telnet, ftp and the old r-commands started from /etc/inetd.conf.
Do not allow direct root login over the network. Use personal accounts and audited privilege escalation.
Send /var/adm/syslog/syslog.log to a central log server so an intruder cannot quietly erase the trail.
Do not store credentials on HP-UX that also work on other systems. Assume they could be stolen.
Check new CVEs for software you run on HP-UX and decide each time whether a firewall rule or a configuration change can block the attack path.

Some third-party maintenance companies offer hardware and software support for HP-UX after HPE. They can help keep machines running, but they cannot issue official HPE patches. Compare offers on what they actually deliver for security problems.

Plan the migration

Isolation buys time; it does not fix anything. A migration plan usually has these steps:

Inventory. For each server: applications, versions, databases, interfaces, users and batch jobs.
Choose the target. A common target is Linux (see Linux). HPE points customers to its current x86 servers, such as HPE ProLiant and HPE Compute Scale-up Server. Check whether each application vendor supports the target system.
Handle custom code. Shell scripts, C programs and cron jobs often use HP-UX commands and paths. Test them early.
Move the data and test. Run the old and new systems side by side, compare results, then switch.
Retire the old server. Wipe the disks and remove the server's firewall rules and accounts.

Commercial Itanium emulators can run an HP-UX image on modern x86 hardware. That removes the dependency on old hardware, but it does not patch HP-UX: the same security limits apply.

Where advisories are published

HPE security bulletins: the HPE Support Center security bulletin library. Existing HP-UX bulletins remain available, but new HP-UX vulnerabilities will not get HPE fixes.
Software you run: follow the advisories of each application and component vendor, and check Vulnerabilities for exploited flaws.

For planning around end-of-life systems in general, see Is my OS supported?.