.NET 8 (LTS) EOL Nov 10, 2026 — Your 12-Week Action Plan

Time is Running Out for .NET 8 (LTS)

Microsoft .NET 8 (LTS) reaches its official end of life on November 10, 2026. With just over three months remaining, organizations still running this version face a critical deadline. Unlike non-LTS releases, .NET 8 was marketed as a long-term support release, meaning it carried a promise of three years of updates. When that clock strikes midnight on November 10, the support window closes permanently.

What changes on November 10, 2026?

• No more security patches or hotfixes from Microsoft.
• No new .NET 8 cumulative updates will be released.
• Microsoft Support will no longer accept tickets or provide SLAs for .NET 8 issues.
• The runtime and SDK will continue to function, but any newly discovered vulnerabilities will remain unpatched by the vendor.

For most enterprise estates, a full migration to .NET 9 (or later) in three months is unrealistic. However, there are concrete steps you can take now to manage the risk while you plan your upgrade.

Week-by-Week Action Plan (Starting Mid-August 2026)

Week 1-2: Inventory and Discovery

• Identify all production and non-production systems running .NET 8 (including ASP.NET Core applications, console apps, and background services).
• Use tools like dotnet --list-sdks and dotnet --list-runtimes on each server, or scan with configuration management tools (e.g., SCCM, Ansible, Azure Arc).
• Document which applications are using .NET 8 and which are using earlier runtimes (e.g., .NET 6, which is also EOL).

Week 3-4: Risk Assessment and Impact Analysis

• For each .NET 8 application, assess the business criticality, data sensitivity, and external exposure.
• Identify applications that are internet-facing or handle regulated data — these pose the highest risk post-EOL.
• Prioritize applications for migration or isolation based on risk score.

Week 5-6: Begin Migration (Priority Apps)

• Start migrating high-risk applications to .NET 9 or .NET 10 (preview/RC) if feasible.
• For .NET 8 to .NET 9, Microsoft provides an upgrade assistant tool (dotnet upgrade-assistant).
• Test thoroughly in a staging environment before production deployment.

Week 7-8: Isolation and Hardening

• For applications that cannot migrate by November 10, implement network segmentation (e.g., firewalls, NSGs) to limit exposure.
• Apply Web Application Firewall (WAF) rules for ASP.NET applications.
• Enable detailed logging and monitoring (e.g., Application Insights, Security Information and Event Management (SIEM) integration) to detect exploitation attempts.

Week 9-10: Vendor and Third-Party Support Engagement

• Engage with a third-party support provider (such as the one offering this blog) to secure extended support for .NET 8 after official EOL.
• Third-party support providers can offer critical security patches, hotfixes, and technical support when Microsoft will not.
• Confirm contract terms, patch delivery methods, and incident response SLAs before November 10.

Week 11-12: Final Preparation and Documentation

• Update your risk register and audit documentation to reflect the EOL status and the compensating controls in place.
• Notify internal security, compliance, and audit teams of the plan.
• Run a final failover or disaster recovery test to ensure isolation measures work.

Why Third-Party Support Matters

When November 10 arrives, Microsoft will stop producing patches for .NET 8. However, the runtime itself does not self-destruct — it continues to run. This means your applications can stay operational, but they will be vulnerable to any new CVEs discovered in the .NET 8 codebase.

Third-party support providers fill that gap. They can backport critical fixes, provide security advisories, and offer technical troubleshooting. This is particularly valuable for:

• Legacy applications that cannot be upgraded without significant re-architecture.
• Compliance requirements that mandate a known-good patch level.
• Organizations that need more time to plan and budget for a full migration.

Next Steps

Do not wait until November 10 to realize you have unpatched systems. Start the inventory today, prioritize your crown jewels, and engage a third-party support provider well before the deadline.

For more information on Microsoft .NET lifecycle details, visit the official Microsoft .NET lifecycle page.

To discuss how third-party support can keep your .NET 8 applications secure past EOL, contact us today.