.NET 8 end of life
.NET 8 reaches end of support on 10 November 2026. It was released on 14 November 2023 as a Long Term Support release, and Microsoft's LTS window is three years. After that date Microsoft stops shipping security patches, servicing updates and technical support for .NET 8, including the runtime, the SDK and the ASP.NET Core and Entity Framework Core packages that ship on the same cadence.
- End of life
- 10 November 2026
- Released
- Nov 2023
- Final release
- 8.0.31
- Successor
- .NET 10 (LTS, supported to 14 November 2028)
Date published by Microsoft .NET support policy. We do not publish a lifecycle date we cannot source.
What actually stops on 10 November 2026
- Security patches for the .NET 8 runtime and SDK, including the ASP.NET Core and EF Core packages released on the .NET 8 cadence.
- Servicing releases: the monthly patch train that has produced 8.0.x updates since November 2023 stops at the final release.
- Microsoft technical support for .NET 8 under a support contract, and the container base images for .NET 8 on Microsoft Artifact Registry stop being rebuilt with OS-level fixes.
- Nothing stops working on 11 November. The runtime keeps executing exactly as it did. What ends is the supply of fixes for whatever is found in it afterwards.
What actually breaks in the upgrade
8 to 10 is the supported jump, and it is two majors
.NET 9 was a Standard Term release and itself goes out of support on 10 November 2026, the same day as 8. That means the only forward move with a support window attached is .NET 10, which runs to 14 November 2028. Teams that planned an 8 to 9 hop to buy time will find both doors close together.
The framework-dependent versus self-contained decision changes the blast radius
Framework-dependent deployments pick up whatever runtime is installed on the host, so a machine-wide runtime upgrade moves every app at once. Self-contained and single-file deployments pin the runtime into the artifact, which means each application has to be rebuilt and redeployed individually. Estates that standardised on self-contained publishing for isolation now pay for it in upgrade coordination.
Breaking changes cluster in serialisation, cryptography and hosting
Across 8 to 10 the changes that reliably break builds are in System.Text.Json defaults, obsoleted cryptography APIs, and ASP.NET Core hosting and authentication surface. Native AOT and trimming warnings that were suppressible in 8 are more frequently errors later. Budget the audit, not just the version bump.
Windows-only surface is the long pole
Applications still carrying System.Web shims, WCF client code, or Windows Forms and WPF interop are where 'just upgrade' stops being true. These are the estates that end up needing extended support on 8 while a separate migration runs.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to .NET 10 | The supported path. Two majors of breaking changes, a full regression cycle, and a redeploy of every self-contained artifact. | Weeks to months depending on Windows-only surface and test coverage | Engineering time only | Right answer if you have the runway and the test suite. Start now: the date is fixed and .NET 9 does not buy you any. |
| Extended support for .NET 8 | Keep running 8 and take CVE patches from a third party while the migration runs on its own schedule. | Days to onboard | Subscription, priced per application or estate rather than per core | Right answer when the audit date arrives before the migration can. Buys a defensible position without pretending the upgrade is done. |
| Stay on 8 unpatched | Accept the risk and document it. Viable only for genuinely isolated workloads with no regulated data and no external exposure. | None | Zero now | Fails PCI DSS 4.0 requirement 6, SOC 2 CC7, and any FDA submission that includes a cybersecurity bill of materials. Know that before you choose it. |
| Re-platform off .NET | Rewrite onto another runtime. | Quarters | Substantial | Almost never justified by an EOL date alone. If it was not already on the roadmap, this date is not the reason to put it there. |
What OSSeva does for .NET 8
OSSeva patches this line
OSSeva provides CVE backports for .NET 8 past 10 November 2026, delivered as signed NuGet packages and container images through your own repository manager. We patch the runtime and the ASP.NET Core and EF Core packages on the .NET 8 cadence. We do not fork the language or the compiler, and we do not add features: a patched 8 stays 8. Where a CVE has no safe backport we say so and publish the mitigation instead of shipping a change that alters behaviour.
.NET extended supportWhat your auditor will say
Requirement 6.3.3 expects critical and high vulnerabilities in system components to be patched within one month of release. An unsupported runtime has no patch to apply, so the control cannot be satisfied by the platform itself; the assessor will look for a compensating control or a third-party patch source.
CC7.1 and CC7.2 cover vulnerability identification and remediation. Auditors increasingly treat 'the vendor no longer supports it' as a finding rather than an explanation, because the control is about your remediation capability, not the vendor's.
A device or supporting system running .NET 8 after the date carries an unsupported component in its software bill of materials. Section 524B submissions expect a plan for it, which in practice means either a documented upgrade schedule or a named support source.
.NET 8: common questions
When does .NET 8 reach end of life?
.NET 8 reaches end of support on 10 November 2026, three years after its release on 14 November 2023. It was a Long Term Support release, and three years is the full LTS window under Microsoft's .NET support policy.
Is .NET 8 still supported?
Yes, until 10 November 2026. Until that date Microsoft ships monthly servicing and security updates on the 8.0.x line. After it, no further patches are published for .NET 8 by Microsoft.
Should I upgrade from .NET 8 to .NET 9 or .NET 10?
.NET 10. .NET 9 is a Standard Term Support release that reaches end of support on the same day as .NET 8, so moving 8 to 9 buys no additional support window. .NET 10 is the LTS release and is supported to 14 November 2028.
What happens if I keep running .NET 8 after end of support?
Applications keep running. What stops is the supply of fixes: any vulnerability found in the .NET 8 runtime after 10 November 2026 will not be patched by Microsoft. Your exposure grows with time rather than all at once, and the compliance problem starts on day one.
Can I get security patches for .NET 8 after end of life?
Yes, from a third-party extended support provider. OSSeva backports CVE fixes to .NET 8 and delivers them as signed NuGet packages and container images. HeroDevs and TuxCare also cover .NET. Microsoft does not offer paid extended support for .NET Core versions the way it does for Windows.
Does running end-of-life .NET fail a PCI or SOC 2 audit?
Not automatically, but it moves the burden onto you. PCI DSS 4.0 requirement 6.3.3 expects high and critical vulnerabilities patched within a month; SOC 2 CC7 expects a working remediation process. Without a patch source you need a documented compensating control, and assessors are less willing to accept one every year.
How long does a .NET 8 to .NET 10 upgrade take?
For a well-tested web application with no Windows-only surface, days. For an estate with WCF clients, System.Web shims, or self-contained deployments that each need rebuilding, weeks to months. The audit of what breaks is usually longer than the fix.
What does extended support for .NET 8 cost?
Third-party extended support is generally priced per application or per estate rather than per core, which makes it substantially cheaper than the per-core commercial licences used elsewhere in the enterprise stack. We size it on the number of applications and environments rather than machine count.
Still running .NET 8?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.