Ubuntu 15.x — End of Life
EOL Actively exploitedUbuntu 15.x reached end of life on Jul 28, 2016, 3739 days ago, and no longer receives security fixes. The most recent release in this series is 15.10. 13 CVEs are tracked for this series, including 2 critical and 1 actively exploited according to CISA KEV. 1 of them was published after the end of life of the affected cycle and will not get an official patch. The next major version is Ubuntu 16. See Ubuntu 16 →
Ubuntu 15.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 15.10 | Oct 22, 2015 | Jul 28, 2016 | Jul 28, 2016 | 15.10 | EOL | |
| 15.04 | Apr 23, 2015 | Feb 4, 2016 | Feb 4, 2016 | 15.04 | EOL |
CVEs affecting Ubuntu 15.x (19)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-31431 | HIGH | 7.8 | 3.43% | KEV | 15.10 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-pla… | Apr 22, 2026 |
| CVE-2026-31431 | HIGH | 7.8 | 3.43% | KEV | 15.04 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-pla… | Apr 22, 2026 |
| CVE-2016-3092 | HIGH | 7.5 | 37.17% | — | 15.10 | The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x bef… | Jul 4, 2016 |
| CVE-2015-8325 | HIGH | 7.8 | 0.60% | — | 15.10 | The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is… | May 1, 2016 |
| CVE-2016-0763 | MEDIUM | 6.3 | 11.29% | — | 15.10 | The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.… | Feb 25, 2016 |
| CVE-2016-0714 | HIGH | 8.8 | 13.07% | — | 15.10 | The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x… | Feb 25, 2016 |
| CVE-2016-0706 | MEDIUM | 4.3 | 6.23% | — | 15.10 | Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache… | Feb 25, 2016 |
| CVE-2016-0494 | CRITICAL | 10.0 | 7.21% | — | 15.10 | Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Jav… | Jan 21, 2016 |
| CVE-2016-0494 | CRITICAL | 10.0 | 7.21% | — | 15.04 | Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Jav… | Jan 21, 2016 |
| CVE-2016-0483 | CRITICAL | 10.0 | 14.71% | — | 15.04 | Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows rem… | Jan 21, 2016 |
| CVE-2016-0483 | CRITICAL | 10.0 | 14.71% | — | 15.10 | Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows rem… | Jan 21, 2016 |
| CVE-2016-0466 | MEDIUM | 5.0 | 5.45% | — | 15.04 | Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u… | Jan 21, 2016 |
| CVE-2016-0466 | MEDIUM | 5.0 | 5.45% | — | 15.10 | Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u… | Jan 21, 2016 |
| CVE-2016-0448 | MEDIUM | 4.0 | 3.53% | — | 15.04 | Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Ja… | Jan 21, 2016 |
| CVE-2016-0448 | MEDIUM | 4.0 | 3.53% | — | 15.10 | Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Ja… | Jan 21, 2016 |
| CVE-2016-0402 | MEDIUM | 5.0 | 4.64% | — | 15.04 | Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Jav… | Jan 21, 2016 |
| CVE-2016-0402 | MEDIUM | 5.0 | 4.64% | — | 15.10 | Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Jav… | Jan 21, 2016 |
| CVE-2015-4000 | LOW | 3.7 | 99.86% | — | 15.04 | The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro… | May 21, 2015 |
| CVE-2015-2808 | LOW | 3.7 | 73.85% | — | 15.04 | The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data duri… | Apr 1, 2015 |
Ubuntu 15.x is EOL — migrate to Ubuntu 16.x
Ubuntu 16.x is the next major release. Plan your upgrade before Ubuntu 15.x stops receiving security patches.
Add a Ubuntu 15 EOL badge to your README
Show your users which Ubuntu version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/ubuntu/15)Frequently asked questions
Is Ubuntu 15 end of life?
Yes. All Ubuntu 15.x releases have reached end of life and no longer receive security patches. There are 13 known CVEs affecting Ubuntu 15.x, including 2 critical. Migrate to Ubuntu 16.x as soon as possible.
What CVEs affect Ubuntu 15?
There are 13 CVEs tracked for Ubuntu 15.x, including 2 critical severity issues and 1 listed in the CISA Known Exploited Vulnerabilities catalog. See the full list above with CVSS and EPSS scores.
What is the latest Ubuntu 15 version?
The latest Ubuntu 15.x patch release is 15.10, released on October 22, 2015. Always run the latest patch to benefit from all security fixes.
How to migrate from Ubuntu 15 to Ubuntu 16?
To migrate from Ubuntu 15 to Ubuntu 16: (1) review the official Ubuntu 16 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Ubuntu 15 in production?
No. Ubuntu 15 has reached end of life and security vulnerabilities are no longer patched. Critically, 1 CVE affecting Ubuntu 15.x is in the CISA KEV catalog — meaning it is actively exploited in the wild. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA