.NET 8 and .NET 9 reach end of support on November 10, 2026: what now?
After November 10, 2026, your .NET 8 and .NET 9 applications will no longer receive security patches. Here is how to assess the risk and plan your move to .NET 10.
On November 10, 2026, Microsoft will stop shipping updates for .NET 8 and .NET 9. Your applications will keep running, but no vulnerability discovered after that date will be fixed. For an organization handling personal or health information, that is a risk best managed before it becomes an incident.
What actually changes on November 10
- No more security patches: a vulnerability published in December will stay open on your servers.
- No more technical support from Microsoft for these versions.
- Dependencies follow: the libraries you rely on will gradually stop testing and shipping for these versions.
The recommended target is .NET 10, a long-term support (LTS) release maintained until November 2028, according to Microsoft's announcement.
Is your application affected?
Ask your team or vendor these three questions:
- Which .NET version does each application run on (including services, APIs and scheduled jobs)?
- Are these applications exposed to the internet, or do they process personal information?
- Who is responsible for updating them, and with what budget?
An isolated internal tool with no sensitive data can wait a few weeks. A client portal or a clinical system should not stay on an unsupported version.
A well-run migration in four steps
- Inventory and audit: versions, dependencies, obsolete code, existing tests.
- Costed plan: what migrates directly, what needs rewriting, and in what order.
- Gradual migration: one application or module at a time, with regression tests to avoid surprises.
- Supported go-live: monitored deployment, then updated documentation.
Moving from .NET 8 to .NET 10 is often straightforward. Older applications (.NET Framework, WebForms) take more work, but it is also a chance to fix pain points that have built up over the years.
What if the deadline is too close?
Time is short before November 10. If a full migration is not possible by then, prioritize internet-facing applications and those handling sensitive data, and step up monitoring of the others in the meantime.
Our team runs these audits and migrations. A short assessment gives you a clear picture and a precise budget before any commitment.