Puppet Enterprise (PE) 2026.0, 2025.12.0, and 2023.8.12 are now available.
- PE 2026.0 highlights include: Puppet Core 9, new operating system support, patch management updates, security updates, and more.
- PE 2025.12.0 moves to our latest-1 release, including critical security and bug fixes.
- PE 2023.8.12 is now in extended support, which ends February 27, 2027. This release includes critical security and bug fixes.
What's New in Puppet Enterprise 2026.0
Built on Puppet Core 9
PE 2026.0 is the first Puppet Enterprise release built on Puppet Core 9. Puppet Core 9 updates key runtime and security foundations, including Ruby 4.0 and OpenSSL 3.5, and adds hardening for certificates, authentication, and server endpoints. Because you inherit these changes when you upgrade, we recommend testing your custom code and modules before rolling out.
Helpful resources:
- Puppet Core 9 release notes
- Puppet Core 9 upgrade documentation
- Puppet Core platform support lifecycle
- Validate your modules for Puppet Core 9 compatibility with Puppet Development Kit (PDK) 4.0
Patch Management Reporting
Patching tasks now report failures that occur while packages are being installed, instead of showing an overall success. Advanced Patching flags failed Windows patch runs as failures in the patch runs report, so your reports reflect what really happened.
Reliable CA Storage Migration and Recovery
PE 2026.0 uses database-backed CA storage by default. To make moving existing CA storage to the database, and recovering afterward, more dependable, this release includes several fixes:
- Puppet runs no longer fail after cleanup
- Missing on-disk CA files are handled
- Mismatched backup restores are rejected up front
- Fresh installs and imports are more reliable
- Recovery no longer writes other nodes' settings into the primary
Security Refresh
PE 2026.0 includes many security updates, covering the Git tooling used by r10k, the nginx and Jetty web servers, FIPS cryptography, logging, and the toolchain used to build PE client tools. See Security Updates below, and Platform Support Updates for operating system changes.
What's Included in PE 2025.12.0 and PE 2023.8.12
PE 2025.12.0
This release moves PE 2025 into the latest-1 release. Highlights for the PE 2025 release include:
- More reliable CA storage: Puppet runs no longer fail after a CA database-storage migration, and intentionally absent local CA files are handled correctly.
- Security updates: See Security Updates below.
PE 2023.8.12 (LTS maintenance and security release)
This release includes security and bug fixes, including updated FIPS cryptography components, the Git tooling used by r10k, and related components. It does not add new features or change platform support.
Important for LTS customers: PE 2023.8.12 does not include the logging library (logback-core) fixes delivered in PE 2026.0 and 2025.12.0, which address CVE-2026-9828, CVE-2026-10532, and CVE-2026-13006. The 2023.8 line uses an older logging library branch that no longer receives upstream updates, so these fixes cannot be applied to it. Support for PE 2023.8.x ends February 27, 2027.
Platform Support Updates
- Agent platform additions: AlmaLinux 10, Rocky Linux 10, Ubuntu 26.04 (AMD), and Ubuntu 26.04 (ARM)
- Primary server platform additions: Ubuntu 26.04
- Platform removals: Ubuntu 20.04 amd64 is removed for the primary server, and several older agent platforms are removed.
- Manual installation: Debian 12 armhf requires manual installation.
Security Updates
All three releases include dependency updates that reduce your security exposure.
| Release | Security updates |
|---|---|
| PE 2026.0 | The broadest refresh: Git tooling used by r10k, nginx, Jetty, logging, FIPS cryptography, the toolchain used to build PE client tools, and many other components, including fixes for critical-severity vulnerabilities. Default PE deployments were assessed as not exploitable for the nginx vulnerabilities addressed. |
| PE 2025.12.0 | Carries forward many of the same updates, including the Git tooling, nginx, Jetty, and client tools toolchain, plus additional dependency updates. |
| PE 2023.8.12 | Updates the FIPS cryptography components (resolving ten vulnerabilities), the Git tooling used by r10k, and related components. Does not include the logging library fixes (see the note for LTS customers above). |
For complete details, specific CVE identifiers, and component versions, see the release notes:
If you have questions about upgrading, contact Puppet Support or your account team.
Thank you for being a Puppet Enterprise customer.
The Puppet Enterprise Team
Top comments (0)