Ishani Ghoshal
on 27 April 2026
Ubuntu 16.04 LTS has reached the end of standard Expanded Security Maintenance with Ubuntu Pro. Here are your options.
Ubuntu 16.04 LTS (Xenial Xerus) reached the end of its five-year Expanded Security Maintenance (ESM) window in April 2026. If you are still running 16.04, it is critical to address your support status to ensure continued security and compliance.
Your support options
Now that 16.04 is in its Legacy phase, you have two primary paths:
- Upgrade to a newer LTS: You can move to a more recent release, such as Ubuntu 24.04 LTS, though note there is no direct upgrade path from 16.04; you must move progressively from 16.04 LTS to 24.04 LTS.
- Activate Legacy add-on: By adding the Legacy add-on to your Ubuntu Pro subscription, you extend security maintenance for an additional five years, bringing the total lifecycle to 15 years (until April 2031).
What is the Legacy add-on?
The Legacy add-on is a specialized extension for LTS releases that have completed their initial 10-year lifecycle. The Legacy add-on offers security patches for the Linux kernel, critical infrastructure, and thousands of open source packages to LTS releases long past their ESM lifecycle, making it ideal for organizations with specialized hardware or proprietary stacks that cannot yet migrate.
The Legacy add-on is available as a premium add-on to an Ubuntu Pro subscription.
What is covered by the Legacy add-on?
- While ESM covers years 5-10 for Ubuntu releases, the Legacy add-on covers years 10-15.
- Canonical provides security maintenance for binary packages across both the ‘main’ and ‘universe’ repositories.
- Critical patches continue for essential packages, including MySQL 5.7, Python 2.7, PostgreSQL 9.5, and NGINX 1.10.
- Support includes OpenStack Mitaka and key components like Ceph and Kubernetes where technically feasible.
Why choose the Legacy add-on?
Migrating a decade-old infrastructure is a massive undertaking. Whether it’s due to complex troubleshooting, hardware compatibility, or strict regulatory requirements (like PCI-DSS or the EU Cyber Resillience Act), sometimes an immediate upgrade isn’t possible.
Legacy add-on allows you to:
- Keep mission-critical systems operational without the risk of unpatched CVEs.
- Continue meeting security standards while your teams focus on long-term migration planning.
- Receive ongoing security patches for your machines.
- Access 24×7 technical support for break fix and bug fix.
What to do next
Running Ubuntu 16.04 without the Legacy add-on after April 2026 means your systems no longer receive security updates, exposing them to potential breaches.
In order to maintain your security posture, it is strongly recommended that you secure your Legacy coverage for Ubuntu 16.04 LTS.
