.NET 8 end of life
.NET 8 reaches end of support on 10 November 2026, the November Patch Tuesday and the last day Microsoft can ship a .NET 8 update. .NET 9 ends the same day. .NET 8 was released on 14 November 2023 as a Long Term Support release. The latest build is 8.0.31, from 8 September 2026. The upgrade target is .NET 10, supported to 14 November 2028.
- End of life
- 10 November 2026
- Released
- Nov 2023
- Final release
- 8.0.31 (latest, 8 September 2026)
- Successor
- .NET 10 (LTS, supported to 14 November 2028)
Date published by Microsoft .NET support policy. We do not publish a lifecycle date we cannot source.
Last reviewed
What actually stops on 10 November 2026
- Security patches for the .NET 8 runtime and SDK, including the ASP.NET Core and EF Core packages released on the .NET 8 cadence. 8.0.31 alone closed five CVEs in September 2026, including CVE-2026-69439, a heap overflow that NVD rates 8.8. Advisories found after 10 November will not reach 8.0.
- Servicing releases. Microsoft ships .NET updates on Patch Tuesday, the second Tuesday of each month, and aligns end-of-support dates with it. That leaves two possible .NET 8 releases: 13 October and 10 November 2026. The policy notes there is no guarantee of a release on any given Patch Tuesday.
- Microsoft technical support for .NET 8, and rebuilt .NET 8 container images on Microsoft Artifact Registry with OS-level fixes.
- Nothing stops working on 11 November. The runtime keeps executing exactly as it did. What ends is the supply of fixes for whatever is found in it afterwards.
What actually breaks in the upgrade
.NET 9 does not buy time
.NET 9 is a Standard Term Support release and reaches end of support on 10 November 2026, the same day as .NET 8. The only forward move with a support window attached is .NET 10, the LTS release, supported to 14 November 2028. .NET 11, at release candidate stage since September 2026, is another Standard Term Support release.
8 to 10 is two majors
The breaking-change review covers both .NET 9 and .NET 10. The changes that reliably break builds are in System.Text.Json defaults, obsoleted cryptography APIs, and ASP.NET Core hosting and authentication surface. Native AOT and trimming warnings that were suppressible in 8 are more often errors later. Budget the audit, not just the version bump.
Self-contained apps each need a rebuild
Framework-dependent deployments pick up whatever runtime is installed on the host, so a machine-wide runtime upgrade moves every app at once. Self-contained and single-file deployments carry their own runtime, so each one has to be rebuilt and redeployed. Count them before you set dates.
Windows-only surface is the long pole
Applications still carrying System.Web shims, WCF client code, or Windows Forms and WPF interop are where a straight upgrade stops being simple. These are the estates that end up needing extended support on 8 while a separate migration runs.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to .NET 10 | Retarget from net8.0 to net10.0, work through two majors of breaking changes, retest, and redeploy every self-contained artifact. | Weeks to months depending on Windows-only surface and test coverage | Engineering time | The destination. Start now: the date is fixed and .NET 9 does not extend it. |
| OSSeva patched .NET 8 | Signed .NET 8 runtimes, ASP.NET Core and EF Core packages with backported security fixes after 10 November 2026. | Days to onboard | Subscription | Right when the audit date arrives before the migration can. Keeps applications patched while the move to 10 runs on its own schedule. |
| Move to .NET 9 or wait for .NET 11 | .NET 9 ends the same day; .NET 11 is a Standard Term Support release. | Weeks | Engineering time | Neither solves 10 November. Skip both and go to 10. |
| Stay on 8 unpatched | Accept the risk and document it. Viable only for isolated workloads with no regulated data and no external exposure. | None | Zero now | Fails PCI DSS 4.0 requirement 6.3.3 and SOC 2 CC7 without a compensating control. Know that before you choose it. |
What OSSeva does for .NET 8
OSSeva patches this line
OSSeva provides CVE backports for .NET 8 past 10 November 2026, delivered as signed NuGet packages and container images through your own repository manager, on the Patch, Assure and Operate tiers. We patch the runtime and the ASP.NET Core and EF Core packages on the .NET 8 cadence. We do not fork the language or the compiler, and we do not add features: a patched 8 stays 8. Where a CVE has no safe backport we say so and publish the mitigation instead of shipping a change that alters behaviour.
.NET extended supportWhat your auditor will say
Requirement 6.3.3 (PCI DSS 4.0.1) expects critical vulnerabilities in system components to be patched within one month of release. An unsupported runtime has no patch to apply, so the control cannot be satisfied by the platform itself; the assessor will look for a compensating control or a third-party patch source.
CC7.1 and CC7.2 cover vulnerability identification and remediation. Auditors increasingly treat 'the vendor no longer supports it' as a finding rather than an explanation, because the control is about your remediation capability, not the vendor's.
A device or supporting system running .NET 8 after the date carries an unsupported component in its software bill of materials. Section 524B submissions expect a plan for it, which in practice means either a documented upgrade schedule or a named support source.
.NET 8: common questions
When does .NET 8 reach end of life?
On 10 November 2026, three years after its release on 14 November 2023. .NET 8 is a Long Term Support release, and Microsoft aligns end-of-support dates with Patch Tuesday, so 10 November is also the last day a .NET 8 update can ship.
What is the final .NET 8 Patch Tuesday?
10 November 2026. Microsoft releases .NET updates on Patch Tuesday, the second Tuesday of each month, and the support policy notes there is no guarantee of a release on any given one. The latest release is 8.0.31, from 8 September 2026.
Does .NET 9 end at the same time as .NET 8?
Yes. .NET 9 is a Standard Term Support release, and Microsoft lists its end of support as 10 November 2026, the same day as .NET 8.
Should I upgrade from .NET 8 to .NET 9 or .NET 10?
.NET 10. .NET 9 reaches end of support on the same day as .NET 8, so moving 8 to 9 buys no support window. .NET 10 is the LTS release and is supported to 14 November 2028.
What happens if I keep running .NET 8 after end of support?
Applications keep running. What stops is the supply of fixes: any vulnerability found in the .NET 8 runtime after 10 November 2026 will not be patched by Microsoft. Exposure grows with time rather than all at once, and the compliance problem starts on day one.
Can I get security patches for .NET 8 after end of life?
Not from Microsoft, which does not sell extended support for .NET 8 the way it does for some Windows releases. OSSeva backports CVE fixes to .NET 8 and delivers them as signed NuGet packages and container images on the Patch, Assure and Operate tiers.
Does running end-of-life .NET fail a PCI or SOC 2 audit?
Not automatically, but it moves the burden onto you. PCI DSS 4.0.1 requirement 6.3.3 expects critical vulnerabilities patched within a month; SOC 2 CC7 expects a working remediation process. Without a patch source you need a documented compensating control, and assessors are less willing to accept one every year.
How long does a .NET 8 to .NET 10 upgrade take?
For a well-tested web application with no Windows-only surface, days. For an estate with WCF clients, System.Web shims, or self-contained deployments that each need rebuilding, weeks to months. The audit of what breaks is usually longer than the fix.
Still running .NET 8?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.