---
title: "CMS & DXP End-of-Support Calendar: 2026–2027"
slug: cms-dxp-end-of-support-calendar-20262027
date: 2026-10-12
author: Nachi Raman
categories: [Migration Guide, Sitecore, Adobe Experience Manager]
excerpt: "Every confirmed CMS and DXP end-of-support date for 2026–2027 in one reference. Sitecore, Kentico, Drupal, AEM, Umbraco, Optimizely, and .NET deadlines."
tldr: "Six CMS/DXP platforms and two .NET runtimes lose vendor patches between August 2026 and February 2027. Most pressure lands between November 10 and December 31, 2026."
canonical: https://clonepartner.com/blog/cms-dxp-end-of-support-calendar-20262027
---

# CMS & DXP End-of-Support Calendar: 2026–2027


# CMS & DXP End-of-Support Calendar: 2026–2027

Six major CMS and DXP platforms hit end-of-support deadlines between now and early 2027. Two .NET runtimes underneath several of them lose patches the same month. This calendar tracks every confirmed date — linked to vendor lifecycle documentation — so you can plan against a single reference instead of checking six different support portals.

**Last verified: 11 October 2026.** We update this page as vendors revise dates. For the broader software EOL landscape (operating systems, databases, productivity suites), see our [complete 2026 EOL calendar](https://clonepartner.com/blog/blog/software-end-of-life-2026-the-complete-eol-calendar).

## The Master Calendar

Every date below is sourced from vendor-published lifecycle documentation. Where a date has already passed, it is marked accordingly.

| Date | Platform & Version | What Changes | Source | Guide |
|---|---|---|---|---|
| **31 Aug 2026** | Adobe Experience Manager 6.5 (Managed Services) | Support has ended | [Adobe releases roadmap](https://experienceleague.adobe.com/en/docs/experience-manager-release-information/aem-release-updates/update-releases-roadmap) |— |
| **10 Nov 2026** | .NET 8 (LTS) and .NET 9 (STS) | Security patches and technical support end | [Microsoft .NET support policy](https://dotnet.microsoft.com/en-us/platform/support/policy) | [The .NET deadline](https://clonepartner.com/blog/blog/net-8-9-end-of-support-the-cms-deadline-everyone-is-missing) |
| **9 Dec 2026** | Drupal 10 | End of life — Drupal 12 ships the same week | [Drupal.org release schedule](https://www.drupal.org/about/core/policies/core-release-cycles/schedule) | [Drupal 10 guide](https://clonepartner.com/blog/blog/drupal-10-end-of-life-upgrade-to-11-wait-for-12-or-replatform) |
| **14 Dec 2026** | Umbraco 13 (LTS) | End of life — all patches cease | [Umbraco 13 EOL page](https://umbraco.com/products/knowledge-center/long-term-support-and-end-of-life/umbraco-13-end-of-life-eol/) | [Umbraco 13 guide](https://clonepartner.com/blog/blog/umbraco-13-end-of-life-2026-xlts-upgrade-migration-guide) |
| **31 Dec 2026** | Kentico Xperience 13 | End of technical support — all patches, maintenance, and support cease | [Kentico support lifecycle](https://www.kentico.com/customers/supportcenter/support-lifecycle) | [Kentico 13 guide](https://clonepartner.com/blog/blog/kentico-xperience-13-end-of-support-2026-what-actually-changes) |
| **31 Dec 2026** | Sitecore XP 10.0 and 10.1 | Extended Support ends — patches unavailable at any price | [Sitecore KB0641167](https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0641167) | [Sitecore guide](https://clonepartner.com/blog/blog/sitecore-xp-end-of-support-2026-the-version-by-version-guide) |
| **28 Feb 2027** | Adobe Experience Manager 6.5 (On-Premise) | Core support planned to end (extended support to 28 Feb 2028) | [Adobe releases roadmap](https://experienceleague.adobe.com/en/docs/experience-manager-release-information/aem-release-updates/update-releases-roadmap) |— |
| **31 Dec 2027** | Sitecore XP 10.2 | Extended Support ends | [Sitecore KB0641167](https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0641167) | [Sitecore guide](https://clonepartner.com/blog/blog/sitecore-xp-end-of-support-2026-the-version-by-version-guide) |
| **31 Dec 2027** | Sitecore XP 10.4 | Mainstream Support ends (Extended Support to 31 Dec 2030) | [Sitecore KB0641167](https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0641167) | [Sitecore guide](https://clonepartner.com/blog/blog/sitecore-xp-end-of-support-2026-the-version-by-version-guide) |
| — | Optimizely CMS 12 | No published EOL date; currently one of two maintained major versions | [Optimizely release notes](https://support.optimizely.com/hc/en-us/articles/11296547622669-Release-notes-by-product/) |— |

> [!NOTE]
> **Two different clocks.** The dates above mark when vendors stop patching the existing platform. They do not describe how long a platform migration, rebuild, or replatform takes — that is a separate project measured in months. If your plan includes moving to a new platform, account for both timelines independently.

## Platform Risk Summary Matrix

This table consolidates the key decision variables across all covered platforms. It is designed to answer the question "how urgent is our situation?" in a single view.

| Platform | Hard Deadline | Paid Extension Available? | Runtime Dependency | Migration Type |
|---|---|---|---|---|
| **Drupal 10** | 9 Dec 2026 | No | PHP / Symfony 6.4 | In-platform: 10→11→12 (not direct) |
| **Umbraco 13** | 14 Dec 2026 | Yes — XLTS in 6/12/24-month blocks | .NET 8 (EOL 10 Nov 2026) | In-place upgrade to Umbraco 15/17 |
| **Kentico Xperience 13** | 31 Dec 2026 | No | .NET 6 (EOL since Nov 2024) | Replatform to Xperience by Kentico |
| **Sitecore XP 10.0/10.1** | 31 Dec 2026 | Yes — paid per post–Jun 2026 model | .NET Framework / .NET 8 (varies) | In-place upgrade to 10.4/10.5, or replatform |
| **AEM 6.5 (AMS)** | 31 Aug 2026 ✓ passed | Yes — AEM 6.5 LTS continuation path | Java 8/11 → Java 17/21 required | Upgrade to AEM 6.5 LTS or migrate to AEMaaCS |
| **AEM 6.5 (On-Prem)** | 28 Feb 2027 | Yes — extended support to Feb 2028 | Java 8/11 → Java 17/21 required | Upgrade to AEM 6.5 LTS or migrate to AEMaaCS |
| **Optimizely CMS 12** | None published | Not applicable | .NET 10 (supported to Nov 2028) | Upgrade to CMS 13 when CMS 14 ships |

**Migration type key:**
- **In-place upgrade** = same vendor platform, version increment, no architectural rewrite required
- **In-platform stepping stone** = same vendor platform, but upgrade must proceed through intermediate versions
- **Replatform** = architectural break between versions; content modeling, custom code, and integrations require rework

## How to Read End of Support, Security Phase, and Extended Support

These labels describe different support states, not synonyms. Read them literally, because vendors use them inconsistently across the industry.

- **End of technical support** means the vendor stops normal support after the stated date, but the product may still run. Kentico says Xperience 13 gets only security hotfixes during 2026, then all support and maintenance stop from January 1, 2027. [Source](https://www.kentico.com/customers/supportcenter/support-lifecycle)
- **Security phase** means the vendor has already narrowed support to security-only work. Umbraco says this phase lasts 12 months for an LTS release; Umbraco 13 entered it on December 14, 2025. [Source](https://umbraco.com/products/knowledge-center/long-term-support-and-end-of-life/)
- **Extended support** does not guarantee the same service level as mainstream support. Sitecore changed this on June 1, 2026 by making production incident support and security updates separate paid options during Extended Support. [Source](https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0641167)
- **Sustaining support** (Sitecore-specific) is the phase after Extended Support ends. In Sustaining Support, security patches are not available at any price — not even through a paid arrangement. The product runs but receives nothing from the vendor.
- **Core support** is Adobe's language for the current AEM 6.5 line before the separate 6.5 LTS branch takes over. Adobe distinguishes Managed Services from on-premises with different dates. [Source](https://experienceleague.adobe.com/en/docs/experience-manager-release-information/aem-release-updates/update-releases-roadmap)

## Compliance Implications of Running Unpatched CMS Software

Running a CMS or its runtime past end-of-support is not only an engineering risk. Several widely adopted compliance frameworks explicitly require patched software dependencies:

- **PCI-DSS v4.0 (Requirement 6.3.3)** mandates that all system components are protected from known vulnerabilities by installing applicable security patches. Running an unpatched CMS on a payment-adjacent infrastructure creates a direct audit finding.
- **SOC 2 (CC7.1)** requires that the organization monitors for vulnerabilities and applies patches within a defined remediation SLA. An EOL CMS with no available patches removes the vendor's ability to provide those patches — the control cannot be satisfied regardless of internal intent.
- **ISO 27001:2022 (Annex A 8.8)** requires management of technical vulnerabilities, including timely patching. An EOL platform that cannot receive patches fails this control by definition.
- **Cyber insurance** underwriters increasingly include software EOL status in application questionnaires. Running production workloads on an EOL CMS can trigger coverage exclusions or premium adjustments at renewal.

These are not hypothetical risks. They are audit findings and coverage conditions that legal and finance teams encounter at renewal cycles.

## .NET 8 and .NET 9: The Runtime Deadline Underneath

**.NET 8 (LTS) and .NET 9 (STS) both reach end of support on November 10, 2026.** After that date, Microsoft stops providing security patches, servicing updates, and technical support for both versions. The recommended upgrade target is **.NET 10**, an LTS release supported through November 2028. [Source](https://dotnet.microsoft.com/en-us/platform/support/policy)

Microsoft's release cycle gives LTS releases like .NET 8 three years of support and STS releases like .NET 9 eighteen months. Because their lifecycles overlap and terminate on the exact same day, any CMS vendor relying on these runtimes faces simultaneous upgrade pressure.

This date matters for the CMS calendar because multiple platforms run on .NET:

- **Kentico Xperience 13** targets .NET 6, which has been unsupported since November 2024 — compounding risk on top of Kentico's own December 2026 deadline.
- **Umbraco 13** targets .NET 8. After November 10, the runtime itself is unpatched — five weeks before Umbraco's own December 14 EOL.
- **Sitecore XP 10.x** versions have varying .NET dependencies. Teams running on .NET 8 need to account for the runtime deadline independently.
- **Optimizely CMS 12** now supports .NET 10, meaning Optimizely teams can step over the November 10 cliff without changing CMS major version at the same time. [Source](https://world.optimizely.com/blogs/bien-nguyen/dates/2026/5/optimizely-cms-12-now-fully-supports-.net-10)

An unpatched runtime exposes the entire application regardless of whether the CMS vendor is still issuing its own patches. Running a supported CMS on an unsupported .NET runtime still violates most enterprise security policies and the compliance frameworks listed above. You cannot decouple the CMS lifecycle from the runtime lifecycle.

For a full breakdown of Microsoft-specific deadlines including SharePoint, Exchange, and Office Online Server, see our [Microsoft 2026 End-of-Support Timeline](https://clonepartner.com/blog/blog/microsoft-2026-end-of-support-timeline-migration-guide).

## Sitecore XP 10.x: Which Versions Lose Support When?

**Sitecore XP 10.0 and 10.1 leave Extended Support on December 31, 2026.** After that date, they enter Sustaining Support, where security patches are not available at any price.

A second change compounds the pressure. **Since June 1, 2026, Sitecore's updated support model makes production incident support and security updates a separate paid arrangement for all versions in Extended Support.** Sitecore did not move the dates on June 1 — it changed what Extended Support includes. Before that date, production incident support and security updates were included. In the updated model, both are marked with **$**, meaning a separate paid arrangement. [Source](https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0641167)

If you are running 10.0 or 10.1 today without that paid extension, you are already operating without standard security patches.

Here is the full version-by-version picture from [KB0641167](https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0641167):

| Version | Mainstream Ends | Extended Ends | Sustaining Ends |
|---|---|---|---|
| **XP 10.0** | Ended | **31 Dec 2026** | 31 Dec 2028 |
| **XP 10.1** | Ended | **31 Dec 2026** | 31 Dec 2028 |
| **XP 10.2** | Ended | **31 Dec 2027** | 31 Dec 2029 |
| **XP 10.3** | Ended | **31 Dec 2028** | 31 Dec 2030 |
| **XP 10.4** | **31 Dec 2027** | 31 Dec 2030 | 31 Dec 2032 |
| **XP 10.5** | 31 Dec 2029 | 31 Dec 2032 | 31 Dec 2034 |

**What each phase means for Sitecore specifically:**
- **Mainstream Support** — full bug fixes, security patches, feature updates, and production incident support included.
- **Extended Support** — security patches and production incident support available, but as of June 1, 2026, both require a separate paid arrangement (marked **$** in KB0641167). No new features.
- **Sustaining Support** — no security patches at any price. Vendor will answer questions and provide workarounds but will not issue fixes. The product runs but is not maintained.

> [!CAUTION]
> For Sitecore 10.0 through 10.3, the date alone is not enough. Always clarify whether you mean mainstream, extended, or sustaining support, and whether security updates are included or separately purchased under the post–June 1, 2026 model.

Sitecore XP 10.5, released on August 5, 2026, resets the support clock for customers willing to upgrade in-place. It carries Mainstream Support through December 2029. For teams on 10.0 or 10.1, the in-platform option that buys the most runway is an upgrade to 10.4 (Mainstream through end of 2027) or 10.5.

## When Does Kentico Xperience 13 Support End?

**Kentico Xperience 13 reaches end of technical support on December 31, 2026.** From January 1, 2027, Kentico ceases all support, maintenance, updates, hotfixes, patches, and security repairs for version 13. [Source](https://www.kentico.com/customers/supportcenter/support-lifecycle)

Kentico Xperience 13 has been in security-only support since January 2026 — no new features or bug fixes, only critical security patches. After December 31, even those stop. **There is no paid extended support offering.** When support ends, it ends.

Kentico Xperience 13 is the final version of Kentico's traditional architecture. The documented forward path is **Xperience by Kentico**, supported by a Migration Toolkit the vendor develops. The architecture changed fundamentally between Xperience 13 and Xperience by Kentico — content modeling, custom code, and integrations all require rework. This is a replatform, not an in-place version upgrade. That rebuild carries its own timeline.

Kentico Xperience 13 also targets **.NET 6**, which has been unsupported since November 2024, compounding the risk well beyond Kentico's own December deadline.

## When Does Umbraco 13 Reach End of Life?

**Umbraco 13 reaches end of life on December 14, 2026.** After that date, Umbraco HQ stops issuing all patches — security, bug fix, and otherwise. [Source](https://umbraco.com/products/knowledge-center/long-term-support-and-end-of-life/umbraco-13-end-of-life-eol/)

Umbraco 13 is a Long-Term Support (LTS) release, shipped on December 14, 2023. Its lifecycle follows Microsoft's .NET LTS cadence: a 24-month support phase plus a 12-month security phase, totalling three years. Umbraco 13 entered its security-only phase on December 14, 2025, and has not received bug fixes for the past ten months.

Umbraco 13 runs on **.NET 8**. Microsoft ends .NET 8 support on November 10, 2026 — about five weeks before Umbraco's own EOL date. On Umbraco Cloud, versions in the security or EOL phase cannot be used for new projects or baselines, so the runtime date affects environment planning, not just patching. [Source](https://umbraco.com/products/umbraco-cms/umbraco-13/)

For teams that cannot upgrade before December, Umbraco offers **Extended Long-Term Support (XLTS)**, purchasable in **6, 12, or 24-month blocks**. XLTS delivers critical security patches through a private NuGet feed but does not add features or fix bugs. Coverage starts the day after EOL and must be continuous — no gaps allowed.

> [!TIP]
> XLTS is a real vendor mechanism for buying time. It is not the same thing as normal support continuing quietly in the background.

The current LTS upgrade target is **Umbraco 17**, released in November 2025, which runs on .NET 10 and carries support through November 2028. Umbraco 15 (released November 2024) is also an active LTS version on .NET 9, though .NET 9 itself reaches end of support on November 10, 2026 — making Umbraco 17 on .NET 10 the safer long-term target.

## Drupal 10 End of Life: December 9, 2026

**Drupal 10 reaches end of life on December 9, 2026.** After that date, the Drupal Security Team stops issuing advisories and patches for all Drupal 10 branches. **Drupal 12 ships the same week** — the week of December 7, 2026. [Source](https://www.drupal.org/about/core/policies/core-release-cycles/schedule)

Drupal's lifecycle is dictated by its underlying PHP framework, Symfony. Because Symfony 6.4 reaches end of life in late 2026, Drupal 10 must follow suit.

A detail that matters right now: **only Drupal 10.6.x still has security coverage.** Sites on 10.5.x lost support in June 2026. Sites on 10.4.x or earlier have been unpatched since December 2025. If your site runs anything below 10.6, the effective deadline has already passed.

**Drupal 10.6.0 is the last minor release of Drupal 10.** The upgrade path to Drupal 12 is not direct — Drupal's update system requires at least Drupal 11 as a stepping stone. The practical route is Drupal 10 → Drupal 11 → Drupal 12.

**Drupal 11 support window:** Drupal 11 shipped in January 2025 and targets Symfony 7.x, which carries active support through November 2027 and security support through November 2028. Drupal 11's own EOL is expected to follow that Symfony cadence. Teams planning a 10→11→12 migration can expect Drupal 11 to remain a viable intermediate target through 2027, but should not treat it as a destination — Drupal 12 is the forward platform.

## Adobe Experience Manager 6.5: Two Deadlines by Hosting Model

**AEM 6.5 support on Adobe Managed Services ended on August 31, 2026.** If your environment is AMS-hosted, the deadline has passed. [Source](https://experienceleague.adobe.com/en/docs/experience-manager-release-information/aem-release-updates/update-releases-roadmap)

**On-premise core support for AEM 6.5 is planned to end on February 28, 2027**, with extended support (critical fixes only) available until February 28, 2028. **Service Pack 6.5.26.0 is the final service pack** for the classic AEM 6.5 line. [Source](https://experienceleague.adobe.com/en/docs/experience-manager-65-lts/content/release-notes/faq)

Adobe's on-premise continuation path is **AEM 6.5 LTS** (a distinct product line, not a version number change — Adobe has not published this as "AEM 6.6"), which refreshes the runtime requirement from Java 8/11 to Java 17 and 21 and removes certain legacy components. The LTS designation here refers to Adobe's long-term servicing commitment for enterprise on-premise customers, not a version increment. **AEM as a Cloud Service (AEMaaCS)** is the other documented forward path.

**Specific removals in AEM 6.5 LTS that affect upgrade assessment:**
- Classic UI (Coral 2-based) components are removed — any custom components built on the legacy UI layer require rewriting.
- Certain deprecated replication and workflow APIs are removed — integration code referencing these APIs will break on upgrade.
- Java 8 runtime compatibility is dropped — the entire deployment stack must move to Java 17 or 21.

Adobe warns that some legacy features and artifacts have been removed in 6.5 LTS, making this a test cycle, not just a contract renewal. Teams should treat the 6.5 → 6.5 LTS transition as a compatibility audit requiring full regression testing.

Migrating off AEM 6.5 — whether to AEMaaCS or to a composable headless CMS — requires extracting data from the Java Content Repository (JCR) and Oak/TarMK architecture. This is a specialized data extraction process that standard API scrapers frequently fail to parse correctly.

## Does Optimizely CMS Have an End-of-Life Date?

**No. As of October 2026, Optimizely has not published an end-of-life date for CMS 12 or CMS 13** in the same dated-matrix style used by Kentico, Sitecore, Umbraco, Drupal, Adobe, or Microsoft. Optimizely's support policy maintains only the current and one prior major version with active bug monitoring, fixes, and security patches. [Source](https://support.optimizely.com/hc/en-us/articles/11296547622669-Release-notes-by-product/)

With CMS 13 reaching general availability on March 31, 2026, the two maintained versions are now **CMS 13 and CMS 12**. CMS 11 fell outside the support window on April 10, 2026.

**Optimizely CMS 13 runtime and support:** CMS 13 targets .NET 9, which reaches end of support on November 10, 2026 — the same day as .NET 8. This makes .NET 10 compatibility for CMS 13 a near-term concern. Optimizely has not published a .NET 10 compatibility statement for CMS 13 as of October 2026; teams running CMS 13 should monitor the Optimizely World release channel for that update. CMS 12's .NET 10 support is confirmed. [Source](https://world.optimizely.com/blogs/bien-nguyen/dates/2026/5/optimizely-cms-12-now-fully-supports-.net-10)

Optimizely states it does not enforce end-of-life through forced upgrades, disabled environments, or removal of access to older versions. Customers on CMS 11 and earlier can continue operating, but routine bug fixes and patches stop — severe security vulnerabilities are handled on a case-by-case basis.

> [!WARNING]
> CMS 12 currently has no published end date, but the pattern is clear: when CMS 14 ships, CMS 12 will leave the actively maintained window. Optimizely CMS 12 now supports .NET 10, which gives it a runtime foundation supported through November 2028. CMS 13 on .NET 9 does not share that runway — .NET 9 expires November 10, 2026.

If you run Optimizely, the better planning question is not "What is the EOL date?" but "Are we on the feature-lead line, the previous critical-fix line, and a supported .NET runtime?" The runtime part is what makes November 10, 2026 important even without a public Optimizely EOL matrix.

## How to Plan Around This Calendar

These dates mark when you lose vendor patches, not when your site stops working. Running unpatched software in production creates security exposure, compliance audit findings under PCI-DSS, SOC 2, and ISO 27001, and potential cyber insurance coverage gaps — all of which compound over time.

**Separate the two clocks.** Engineering teams facing an end-of-support deadline often conflate two timelines: the time to rebuild the application and the time to move the data. These are different workstreams. The application rebuild — rewriting front-end components, updating schemas, retraining content editors — is a capital-intensive project that is, in our estimation, a matter of months rather than weeks. The data migration — extracting content, assets, and relational metadata from the old platform and loading it into the new one — is a separate track. Start scoping the data migration at least **3–4 months** before your internal go-live deadline so the application rebuild has real data to test against.

**Check where you actually are.** Several platforms have sub-deadlines that have already passed:

- Drupal 10.5.x lost security support in June 2026
- Sitecore's paid Extended Support model took effect June 1, 2026
- .NET 6 has been unpatched since November 2024
- AEM 6.5 on Managed Services passed its deadline August 31, 2026
- Optimizely CMS 11 lost support April 10, 2026

**Know what you can buy.** Not every vendor offers a paid extension:

| Platform | Paid Extension Available? | Form | Scope |
|---|---|---|---|
| **Umbraco 13** | Yes | XLTS in 6, 12, or 24-month blocks | Critical security patches via private NuGet feed; no bug fixes |
| **Sitecore XP** | Yes (Extended Support phase only) | Separate paid arrangement post–Jun 1, 2026 | Production incident support + security patches, while in Extended phase |
| **AEM 6.5 (On-Prem)** | Yes | Extended support to Feb 2028 | Critical fixes only after core support ends |
| **Optimizely** | Partial | No formal paid extension; severe vulns handled case-by-case | No SLA-backed commitment |
| **Kentico Xperience 13** | No | None | Support terminates completely Jan 1, 2027 |
| **Drupal 10** | No | None | Security team coverage stops at EOL |

> If one of these deadlines is forcing a platform decision, separate the application program from the data program. ClonePartner handles the data migration — API-first, with field-level validation and zero downtime where the source system's API supports it. Book a free 30-minute scoping call and get a fixed-price proposal.
>
> [Talk to us](https://clonepartner.com/talk-to-us?duration=30&utm_source=blog&utm_medium=button&utm_campaign=demo_bookings&utm_content=cta_click&utm_term=demo_button_click)

## Frequently asked questions

### When does Sitecore XP 10 Extended Support end?

It depends on the minor version. Sitecore XP 10.0 and 10.1 leave Extended Support on December 31, 2026. XP 10.2 extends to December 2027, 10.3 to December 2028, and 10.4 Mainstream Support ends December 2027. Since June 1, 2026, production incident support and security updates during Extended Support are a separate paid arrangement.

### When does Kentico Xperience 13 support end?

Kentico Xperience 13 reaches end of technical support on December 31, 2026. From January 1, 2027, Kentico ceases all patches, hotfixes, maintenance, and technical support. There is no paid extended support option.

### When does Drupal 10 reach end of life?

Drupal 10 reaches end of life on December 9, 2026, the same week Drupal 12 ships. Only the 10.6.x branch still has security coverage — sites on 10.5.x or earlier are already unpatched. The upgrade path to Drupal 12 requires going through Drupal 11 first.

### Why does .NET 8 end of support matter if my CMS date is later?

Because the runtime can age out before the CMS does. Microsoft ends .NET 8 and .NET 9 support on November 10, 2026. Umbraco 13 runs on .NET 8, so the runtime loses patches five weeks before Umbraco's own December 14 EOL. An unpatched runtime exposes the entire application regardless of whether the CMS vendor is still issuing its own patches.

### Does Optimizely CMS 12 have an end-of-life date?

No. As of October 2026, Optimizely has not published a fixed end-of-life date for CMS 12. Optimizely maintains only the current and one prior major version (currently CMS 13 and CMS 12). When CMS 14 ships, CMS 12 will leave the actively maintained window. CMS 12 now supports .NET 10, giving it a supported runtime through November 2028.