.NET 6 LTS End of Life Nov 12, 2024: 90-Day Action Plan

The Clock is Ticking on .NET 6 LTS: Your 90-Day Action Plan for EOL on November 12, 2024

With Microsoft .NET 6 (LTS) reaching end of life (EOL) on November 12, 2024, you have roughly three months to prepare. For most IT estates, a complete migration to .NET 8 or later within that window is unrealistic. This article focuses on what you can do now: inventory, isolate, document, and secure support for the gap.

What Happens on November 12, 2024?

On the EOL date, Microsoft ends all support and patching for .NET 6 (including security fixes, bug fixes, and technical support). The latest build—6.0.36—is the final release. After that:

• No more security updates. Any new CVEs discovered after November 12 will not be patched by Microsoft.
• No more bug fixes. Existing or newly reported runtime or framework issues will not be addressed.
• No vendor SLAs. Microsoft will not provide any support contracts or hotfixes for .NET 6.
• Compliance gaps. Many industry standards (PCI-DSS, SOC 2, HIPAA) require active vendor support for production systems. Running .NET 6 after EOL may create audit findings.

Your 90-Day Checklist

Week 1-2: Full Inventory

• Run automated scans (e.g., using your configuration management database or dependency scanners) to locate every server, container, desktop installation, and CI/CD pipeline using .NET 6.
• Document which applications rely on .NET 6 and whether you control the source code, use third-party products, or have no migration option.
• Flag any high-risk or externally exposed applications.

Week 3-4: Isolate and Harden

• For systems that cannot be migrated before November 12, apply a compensating control strategy:
  • Restrict outbound network access for .NET 6 servers.
  • Place them behind a web application firewall (WAF) or reverse proxy.
  • Apply the final 6.0.36 update to all instances.
  • Enable strict runtime hardening where possible (e.g., tiered compilation, data execution prevention).
• Document all compensating controls for audit purposes.

Week 5-6: Document Exposure

• Create a formal risk register entry listing each .NET 6 dependency, its criticality, and the business impact of a zero-day.
• Inform your GRC (governance, risk, and compliance) team and internal auditors about the EOL status.
• Update your disaster recovery and incident response plans to account for the lack of vendor patches for .NET 6.

Week 7-8: Evaluate Migration or Third-Party Support

• For in-house applications, begin architecting a migration to .NET 8 or a supported alternative. Prioritize high-risk systems.
• For third-party products that bundle .NET 6, check if the vendor offers a patch or upgrade path.
• If migration is impossible before EOL, line up a support contract that will start on November 12 to fill the gap.

Week 9-10: Final Hardening & Testing

• Perform regression testing on all .NET 6 applications with the 6.0.36 update.
• Verify that compensating controls (WAF, network segmentation, intrusion detection) are correctly configured for the isolated systems.
• Test your updated incident response procedures against a simulated unpatched vulnerability.

Week 11-12: Day-One Prep

• Ensure support coverage begins on November 12 with no lapse.
• Communicate final EOL status to all stakeholders—including procurement, legal, and risk teams.
• Schedule a post-EOL review for December to reassess any remaining .NET 6 dependencies.

Why Third-Party Support Matters Now

Even with isolation, unpatched .NET 6 systems present residual risk. A third-party support provider like 3rd Party Support can bridge the gap after November 12, offering:

• Security patches and hotfixes for .NET 6 outside Microsoft’s lifecycle.
• Compliance documentation for auditors and insurers.
• Extended runway for migration without rushing into production outages.

The Next Step

You cannot stop the EOL date, but you can control how you manage the transition. Use the next 12 weeks to secure your estate and document your risk posture. For systems that must stay on .NET 6 beyond November 12, contact us to discuss post-EOL support options.