Ubuntu 20.04 LTS reached the end of standard security maintenance in May 2025. It now receives security updates only through Expanded Security Maintenance (ESM), which requires an Ubuntu Pro subscription and runs to 2030. Without ESM, a 20.04 machine gets no new security fixes.
Standard support versus ESM
Ubuntu long term support releases come with five years of standard security maintenance. After that, ESM extends coverage for a further period. Canonical's release cycle page lists the dates for the last three LTS releases.
| Release | Standard maintenance ends | ESM ends |
|---|---|---|
| 20.04 | May 2025 | 2030 |
| 22.04 | 2027 | 2032 |
| 24.04 | 2029 | 2034 |
The release page says continued coverage for 20.04 requires Ubuntu Pro. endoflife.date gives the exact days: 31 May 2025 for standard maintenance and 23 April 2030 for ESM on 20.04, and 1 June 2027 and 21 April 2032 for 22.04.
What ESM does and does not do
ESM is a security patching service. It is not a promise that the whole system stays current. Application stacks you installed yourself, such as a language runtime from another source, a container image or a vendor package, are outside it. A fully patched base can still host an out of support runtime on top.
Treat ESM as time bought, not a destination. Put a date on it in your register and review it when that date is a year away. Every year on 20.04 widens the gap between your system and the software around it.
How to pick a path
- Count the machines. If it is a handful, an in place upgrade is usually a short project.
- Check the workload. Databases and long lived services deserve a rehearsal on a clone first.
- Look at the application. If it requires old library versions, you may need to port it or accept ESM for a while.
- Decide a deadline. If you take ESM, write the date you will leave it.
Upgrades go one LTS at a time, so 20.04 moves to 22.04 first and then to 24.04. Test each hop.
Check for forgotten machines
The hardest part is rarely the upgrade itself. It is knowing which machines exist.
Old releases hide in places people stop looking: build agents, jump hosts, lab VMs and base images pinned long ago. Run lsb_release -a or read /etc/os-release across your fleet and in your container base images.
Quick check
Does 20.04 still get any updates?
Only through ESM with Ubuntu Pro. Standard security maintenance ended in May 2025.
Can I skip from 20.04 straight to 24.04?
Supported upgrades go from one LTS to the next. Plan 20.04 to 22.04, then 22.04 to 24.04, testing in between.
Where Safeguard fits
Safeguard's container image scanning and asset discovery help you find which images and hosts still carry an old base. Start with the free scan.
Sources
Last reviewed: 19 October 2026.
