.NET 8 end of life: 10 November 2026, and your two options
.NET 8 and .NET 9 reach end of support on 10 November 2026, the last day Microsoft ships a security update for either, and its support policy lists no paid extension. After that date new vulnerabilities go unpatched. Upgrade to .NET 10, supported until 14 November 2028, or stay on .NET 8 or 9 with OSSeva extended support.
Option 1
Upgrade to .NET 10
.NET 10 is the LTS release, supported by Microsoft until 14 November 2028. Retarget from net8.0 to net10.0, work through the breaking changes, retest and redeploy.
Read the upgrade guideOption 2
Stay on .NET 8 with extended support
OSSeva backports security fixes to .NET 8 and .NET 9 after 10 November 2026, as signed builds for Windows and Linux. Critical CVEs are patched within 48 hours and High within 7 days.
See what extended support coversTrusted globally by enterprises
- End of life
- 10 November 2026
- Released
- Nov 2023
- Final release
- 8.0.33 (latest, 25 October 2026)
- Successor
- .NET 10 (LTS, supported to 14 November 2028)
Date published by Microsoft .NET support policy. We do not publish a lifecycle date we cannot source. Dates checked on endoflife.date on 20 October 2026.
Last reviewed
When .NET 8 and .NET 9 support ends
Microsoft supports .NET 8 and .NET 9 until 10 November 2026, the November Patch Tuesday. .NET 8 is a Long Term Support release with three years of support and .NET 9 a Standard Term Support release with two, so the two windows close on the same day. .NET 10 is the only current release with a longer window. Dates checked on endoflife.date on 20 October 2026.
.NET support dates, checked 20 October 2026
| Version | Type | Released | Microsoft support ends | Latest release |
|---|---|---|---|---|
| .NET 8 | LTS | 14 Nov 2023 | 10 Nov 2026 | 8.0.33 (25 Oct 2026) |
| .NET 9 | STS | 12 Nov 2024 | 10 Nov 2026 | 9.0.22 (25 Oct 2026) |
| .NET 10 | LTS | 11 Nov 2025 | 14 Nov 2028 | 10.0.13 (13 Oct 2026) |
Source: endoflife.date/dotnet and Microsoft's .NET support policy.
What changes on 10 November 2026
- Security patches for the .NET 8 runtime and SDK, including the ASP.NET Core and EF Core packages released on the .NET 8 cadence. Microsoft's release metadata lists 40 CVEs against 8.0.32, the October 2026 release, and 3 more fixed in 8.0.33, an out-of-band security release on 25 October 2026. Advisories found after 10 November will not reach 8.0.
- Servicing releases. Microsoft ships .NET updates on Patch Tuesday, the second Tuesday of each month, and aligns end-of-support dates with it. The October release, 8.0.32, shipped on 13 October 2026, and an out-of-band security release, 8.0.33, followed on 25 October 2026. That leaves 10 November 2026 as the last possible .NET 8 release. The policy notes there is no guarantee of a release on any given Patch Tuesday.
- Microsoft technical support for .NET 8, and rebuilt .NET 8 container images on Microsoft Artifact Registry with OS-level fixes.
- Nothing stops working on 11 November. The runtime keeps executing exactly as it did. What ends is the supply of fixes for whatever is found in it afterwards.
Upgrade to .NET 10: effort and risks
.NET 9 does not buy time
.NET 9 is a Standard Term Support release and reaches end of support on 10 November 2026, the same day as .NET 8. The only forward move with a support window attached is .NET 10, the LTS release, supported to 14 November 2028. .NET 11, at release candidate stage since September 2026, is another Standard Term Support release.
8 to 10 is two majors
The breaking-change review covers both .NET 9 and .NET 10. The changes that reliably break builds are in System.Text.Json defaults, obsoleted cryptography APIs, and ASP.NET Core hosting and authentication surface. Native AOT and trimming warnings that were suppressible in 8 are more often errors later. Budget the audit, not just the version bump.
Self-contained apps each need a rebuild
Framework-dependent deployments pick up whatever runtime is installed on the host, so a machine-wide runtime upgrade moves every app at once. Self-contained and single-file deployments carry their own runtime, so each one has to be rebuilt and redeployed. Count them before you set dates.
Windows-only surface is the long pole
Applications still carrying System.Web shims, WCF client code, or Windows Forms and WPF interop are where a straight upgrade stops being simple. These are the estates that end up needing extended support on 8 while a separate migration runs.
Stay on .NET 8: extended support and what it covers
OSSeva patches this line
OSSeva provides CVE backports for .NET 8 past 10 November 2026, delivered as signed builds through your own repository manager, on the Patch, Assure and Operate tiers: installers for Windows, and apt and yum packages, Docker images and binaries for Linux. We patch the runtime and the ASP.NET Core and EF Core packages on the .NET 8 cadence. We do not fork the language or the compiler, and we do not add features: a patched 8 stays 8. Where a CVE has no safe backport we say so and publish the mitigation instead of shipping a change that alters behaviour.
.NET extended supportHow fast fixes arrive
These are the same commitments published on the OSSeva Patch, Assure and Operate pages, and they apply to .NET 8 and .NET 9 after 10 November 2026.
Patch and response commitments
| Request | Commitment | Tier |
|---|---|---|
| Critical vulnerability (CVSS 9.0 or higher) | Patched within 48 hours | Patch |
| High-severity vulnerability | Patched within 7 days | Patch |
| Everything else | Quarterly batch | Patch |
| Any issue, at any hour | 24/7 reactive support: an OSSeva engineer works it with you | Assure |
| P1 incident | 15-minute response, 24/7 | Operate |
CVEs already fixed on .NET 8
These are the .NET 8 fixes recorded in OSSeva's CVE directory, newest first. An extended-support build starts from Microsoft's last release and carries every one of them forward, then adds the fixes for advisories published after 10 November 2026.
.NET 8 CVEs in the OSSeva CVE directory
| CVE | CVSS | Published | Issue | Fixed in .NET 8 |
|---|---|---|---|---|
| CVE-2026-62898 | 7.5 | 11 Aug 2026 | .NET: use after free in Microsoft QUIC discloses memory | 8.0.30 |
| CVE-2026-47304 | 9.8 | 14 Jul 2026 | .NET: EncryptedXml signature verification flaw allows security feature bypass | 8.0.29 |
| CVE-2026-47303 | 8.8 | 14 Jul 2026 | ASP.NET Core Negotiate authentication: improper parsing allows elevation of privilege | 8.0.29 |
| CVE-2026-47300 | 8.8 | 14 Jul 2026 | ASP.NET Core Negotiate authentication: incorrect validation with LDAP roles allows elevation of privilege | 8.0.29 |
| CVE-2026-50528 | 8.2 | 14 Jul 2026 | .NET SslStream: authorization checks can be bypassed on TLS connections | 8.0.29 |
| CVE-2026-45591 | 7.5 | 9 Jun 2026 | ASP.NET Core SignalR and Blazor Server: deeply nested MessagePack arrays cause denial of service | 8.0.28 |
| CVE-2025-55315 | 9.9 | 14 Oct 2025 | ASP.NET Core Kestrel: HTTP request smuggling allows security feature bypass | 8.0.21 |
| CVE-2024-0057 | 9.8 | 9 Jan 2024 | .NET: X.509 chain building returns an incorrect failure reason | 8.0.1 |
The directory lists .NET CVEs with a CVSS score of 7.0 or higher, matched at NVD to the product, so it is a subset of every .NET advisory. CVSS is NVD's score where NVD has scored the record, otherwise Microsoft's score as the CNA. Fixed-in versions are from Microsoft's advisories.
Other end-of-life dates in the same window
A .NET 8 estate rarely runs alone. PostgreSQL 14 loses community support on 12 November 2026, two days after .NET 8, and Apache Tomcat 9.0 follows on 31 March 2027 for the Java services beside it. SQL Server is the database under many .NET applications.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to .NET 10 | Retarget from net8.0 to net10.0, work through two majors of breaking changes, retest, and redeploy every self-contained artifact. | Scales with Windows-only surface, test coverage and the number of self-contained apps | Engineering time | The destination. Start now: the date is fixed and .NET 9 does not extend it. |
| OSSeva patched .NET 8 | Signed .NET 8 runtimes, ASP.NET Core and EF Core packages with backported security fixes after 10 November 2026, for Windows (installers) and Linux (apt, yum, Docker, binaries). | Install the patched runtime or image | Subscription | Right when the audit date arrives before the migration can. Keeps applications patched while the move to 10 runs on its own schedule. |
| Move to .NET 9 or wait for .NET 11 | .NET 9 ends the same day; .NET 11 is a Standard Term Support release. | A second upgrade project | Engineering time | Neither solves 10 November. Skip both and go to 10. |
| HeroDevs Never-Ending Support for .NET 8 | HeroDevs describes NES for .NET 8 as a drop-in replacement runtime with security patches and CVE remediation for Windows and Linux, published alongside Microsoft's Patch Tuesday releases. | Replace the runtime or image | Quote-based; no price published | A direct alternative to ours for .NET 8. Ask each vendor for its delivery scope, SLA and the date patches start, then compare. |
| TuxCare ELS for .NET | TuxCare's published ELS for .NET page lists .NET 6, 8 and 10 on Windows (Nano Server, Windows 10 and 11, Windows Server). Downloads come through a tokenized URL and updates are installed manually. | Request access, install the patched runtime | Quote-based; no price published | Fits a Windows-only estate. For Linux hosts or containers, ask whether and how they are covered. OSSeva covers both Windows and Linux. |
| Stay on 8 unpatched | Accept the risk and document it. Viable only for isolated workloads with no regulated data and no external exposure. | None | Zero now | Fails PCI DSS 4.0 requirement 6.3.3 and SOC 2 CC7 without a compensating control. Know that before you choose it. |
What your auditor will say
Requirement 6.3.3 (PCI DSS 4.0.1) expects critical vulnerabilities in system components to be patched within one month of release. An unsupported runtime has no patch to apply, so the control cannot be satisfied by the platform itself; the assessor will look for a compensating control or a third-party patch source.
CC7.1 and CC7.2 cover vulnerability identification and remediation. Auditors increasingly treat 'the vendor no longer supports it' as a finding rather than an explanation, because the control is about your remediation capability, not the vendor's.
A device or supporting system running .NET 8 after the date carries an unsupported component in its software bill of materials. Section 524B submissions expect a plan for it, which in practice means either a documented upgrade schedule or a named support source.
When does .NET 8 support end?
On 10 November 2026, three years after its release on 14 November 2023. .NET 8 is a Long Term Support release, and Microsoft aligns end-of-support dates with Patch Tuesday, so 10 November is also the last day a .NET 8 update can ship. endoflife.date lists the same date, checked on 20 October 2026.
Is .NET 8 still supported?
Yes, until 10 November 2026. Microsoft is still shipping .NET 8 security updates: the latest is 8.0.33, an out-of-band security release on 25 October 2026. After 10 November 2026 there are no further .NET 8 patches from Microsoft.
How long will .NET be supported?
Each .NET release has a fixed window. Even-numbered releases are Long Term Support with three years of support, and odd-numbered releases are Standard Term Support with two. .NET 8 and .NET 9 both end on 10 November 2026, and .NET 10, the current LTS release, is supported until 14 November 2028.
How long will .NET 9 be supported?
.NET 9 is a Standard Term Support release, supported for two years from 12 November 2024, so it ends on 10 November 2026, the same day as .NET 8. Moving from .NET 8 to .NET 9 buys no extra time.
Is .NET still relevant in 2026?
Yes. Microsoft released .NET 10 as a Long Term Support release on 11 November 2025 and supports it until 14 November 2028, and .NET 11 has been at release candidate stage since September 2026. The question for most teams is not whether to stay on .NET but which supported line to run.
What is the final .NET 8 Patch Tuesday?
10 November 2026. Microsoft releases .NET updates on Patch Tuesday, the second Tuesday of each month, and the support policy notes there is no guarantee of a release on any given one. The latest release is 8.0.33, an out-of-band security release from 25 October 2026.
Should I upgrade from .NET 8 to .NET 9 or .NET 10?
.NET 10. .NET 9 reaches end of support on the same day as .NET 8, so moving 8 to 9 buys no support window. .NET 10 is the LTS release and is supported to 14 November 2028.
What happens if I keep running .NET 8 after end of support?
Applications keep running. What stops is the supply of fixes: any vulnerability found in the .NET 8 runtime after 10 November 2026 will not be patched by Microsoft. Exposure grows with time rather than all at once, and the compliance problem starts on day one.
What are the best options for organizations running .NET 8 applications that need continued CVE coverage past end of life?
Upgrade to .NET 10 where you can, and put a third-party patch source under the applications that cannot make the date. OSSeva backports security fixes to .NET 8 and .NET 9 as signed runtime, ASP.NET Core and EF Core builds for Windows and Linux, so those applications keep receiving CVE fixes while the upgrade runs. Staying unpatched is the third option and needs a documented compensating control.
Which vendors will provide extended lifecycle support for organizations that remain on .NET 8 past end of life?
Microsoft does not: its support policy lists no paid extension. Third-party providers include OSSeva, HeroDevs and TuxCare, and Canonical maintains the .NET 8 packages in Ubuntu 22.04 and 24.04 for the life of those releases. They differ on versions, operating systems, delivery and response commitments, and the extended support page compares them.
Can I get security patches for .NET 8 after end of life?
Not from Microsoft. OSSeva delivers .NET 8 security fixes as signed builds on the Patch, Assure and Operate tiers: installers for Windows, and apt and yum packages, container images and binaries for Linux. Critical vulnerabilities (CVSS 9.0 or higher) are patched within 48 hours and High within 7 days.
Does running end-of-life .NET fail a PCI or SOC 2 audit?
Not automatically, but it moves the burden onto you. PCI DSS 4.0.1 requirement 6.3.3 expects critical vulnerabilities patched within a month; SOC 2 CC7 expects a working remediation process. Without a patch source you need a documented compensating control, and assessors are less willing to accept one every year.
How long does a .NET 8 to .NET 10 upgrade take?
It depends on the estate, not the version bump. A well-tested web application with no Windows-only surface moves fastest. WCF clients, System.Web shims and self-contained deployments that each need rebuilding add scope, and the audit of what breaks is usually longer than the fix. Count the applications and their dependencies before you set dates.
Get a quote
Still running .NET 8?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.
Prefer to talk or read more first?