Canonical Ubuntu 20.04 LTS vulnerabilities

6 CVEs affecting Canonical Ubuntu 20.04 LTS, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-15226, published 2026-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-11386, published 2026-07-16. Critical severity, CVSS 9.0. EPSS: 0.5% chance of exploitation in the next 30 days. An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as…
CVE-2026-12391, published 2026-07-16. Medium severity, CVSS 5.0. EPSS: 0.2% chance of exploitation in the next 30 days. An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes…
CVE-2026-15226, published 2026-07-21. High severity, CVSS 8.4. EPSS: 0.2% chance of exploitation in the next 30 days. A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine…
CVE-2026-9494, published 2026-07-16. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper…
CVE-2026-12249, published 2026-06-22. Critical severity, CVSS 9.0. EPSS: 0.1% chance of exploitation in the next 30 days. An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certificate auto-enrollment via the vendored Samba client script…
CVE-2024-5300, published 2026-07-21. Medium severity, CVSS 5.6. EPSS: 0.1% chance of exploitation in the next 30 days. An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in…