# RHEL’s standard security errata cover Critical, Important and CVSS 7+ Moderate CVEs on active minor releases only > Red Hat’s RHEL life cycle page defines standard security errata as Critical, Important and Moderate CVEs with a CVSS score of 7 or higher, effective April 1, 2025, and applies the policy only to active minor releases. RHEL 8, 9 and 10 have ten-year life cycles, and ELCP is now Red Hat’s unified extended support model. - Canonical URL: https://update.dsesecurity.com/updates/rhel-errata-policy-moderate-cvss-7-active-minor-releases-elcp/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-18T21:01:23+00:00 - Modified: 2026-10-18T22:22:08+00:00 - Last reviewed by DSE: 2026-10-18 - Resource type: Briefing - DSE priority: Advisory - Topics: Cybersecurity, IT - Reading time: 2 minutes ## What you need to know Red Hat’s RHEL life cycle page defines standard security errata as Critical, Important and Moderate CVEs with a CVSS score of 7 or higher, effective April 1, 2025, and applies the policy only to active minor releases. RHEL 8, 9 and 10 have ten-year life cycles, and ELCP is now Red Hat’s unified extended support model. ## Potentially affected Organizations running Red Hat Enterprise Linux 8, 9 or 10, and the security teams whose vulnerability scanners report CVEs on those systems. ## DSE recommendation DSE recommends keeping RHEL systems on an active minor release and reconciling scanner findings against Red Hat’s errata criteria rather than assuming every reported CVE will receive a fix. ## Article Red Hat’s RHEL life cycle page defines standard security errata as Critical, Important and Moderate CVEs with a CVSS score of 7 or higher, effective April 1, 2025, and applies the policy only to active minor releases. RHEL 8, 9 and 10 have ten-year life cycles, and ELCP is now Red Hat’s unified extended support model. ## Source facts Red Hat’s [RHEL life cycle page](https://access.redhat.com/support/policy/updates/errata) defines standard security errata as Critical, Important and Moderate CVEs with a CVSS score of 7 or higher, effective April 1, 2025, as defined by Red Hat, and says all errata are provided at Red Hat’s discretion. The security and bug fix maintenance policies apply only to current active minor releases, and Application Stream packages may have a shorter life cycle than a minor release. RHEL 8, 9 and 10 deliver a ten-year life cycle across Full Support and Maintenance Support Phases, followed by an Extended Life Phase in which no bug fixes or security fixes are available. RHEL Standard provides a 6-month life cycle for each minor release, RHEL Premium a 2-year life cycle for eligible minor releases, and Extended Life Cycle Premium extends eligible minor releases to 6 years from general availability, with 9 years for the final minor release. Red Hat says it has unified extended support under ELCP beginning with RHEL 9, replacing the separate EUS, Enhanced EUS and E4S offerings, and that ELCP replaces Extended Life Cycle Support beginning with RHEL 8.10 on 6/1/2029. Red Hat says future end dates are close approximations and subject to change. ## Applicability Use this for RHEL subscribers. Red Hat’s dates table and severity definitions are on its Customer Portal; check the current dates for each major and minor release, which Red Hat says may change. ## DSE recommendation DSE recommends keeping RHEL systems on an active minor release and reconciling scanner findings against Red Hat’s errata criteria rather than assuming every reported CVE will receive a fix. Track the minor release and subscription tier for each system, plan upgrades before a minor release leaves support, and document compensating controls for findings Red Hat does not plan to fix. ## Verification Each quarter, compare the fleet’s RHEL minor releases with Red Hat’s published dates, confirm errata are applying, and review open scanner findings against Red Hat’s CVE pages. ## Official reference [Red Hat Customer Portal — Red Hat Enterprise Linux Life Cycle](https://access.redhat.com/support/policy/updates/errata). Reviewed October 18, 2026. ## Primary reference - Name: Red Hat Customer Portal — Red Hat Enterprise Linux Life Cycle - Authority: access.redhat.com - URL: https://access.redhat.com/support/policy/updates/errata - Source publication date: Not stated by the source ## Citation and use Preferred citation: “RHEL’s standard security errata cover Critical, Important and CVSS 7+ Moderate CVEs on active minor releases only,” DSE Security, https://update.dsesecurity.com/updates/rhel-errata-policy-moderate-cvss-7-active-minor-releases-elcp/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.