Umbraco 13 End of Life (2026): XLTS, Upgrade & Migration Guide

Umbraco 13 End of Life (2026): XLTS, Upgrade & Migration Guide

Umbraco 13 reaches end of life on 14 December 2026. After that date, Umbraco HQ stops shipping security patches, bug fixes, and official support. Your site keeps running — but every vulnerability discovered after that date stays open. (umbraco.com)

The detail most planning conversations miss: Microsoft ends support for .NET 8 and .NET 9 on 10 November 2026 — 34 days before the CMS itself loses support. That makes this a stacked-support problem, not a routine version bump: two separate support clocks expire within five weeks, and only one of them (the CMS layer) has a paid extension available.

This guide covers the three options available to teams running Umbraco 13: XLTS (Umbraco's paid post-EOL security coverage), upgrading to Umbraco 17 LTS, and replatforming to a different system. XLTS gets particular attention because it is a genuinely differentiated option that most other CMS vendors facing a 2026 deadline do not offer — but it has a runtime-layer gap that most Umbraco partner posts obscure or omit entirely.

For a consolidated view of every major 2026 end-of-life event, see our complete EOL calendar.

What does Umbraco 13 end of life actually mean?

End of life (EOL) for an Umbraco version means Umbraco HQ permanently stops issuing updates and support for that release — security patches, bug fixes, and technical assistance all cease.

Umbraco 13 was released on 14 December 2023 as a Long-Term Support (LTS) version. LTS versions follow a three-year lifecycle: 24 months of full support followed by 12 months of security-only patches. The security-only phase began on 14 December 2025, meaning Umbraco 13 has received only security fixes — no bug fixes or feature work — since that date. (umbraco.com)

Umbraco's own knowledge centre is explicit: while projects will technically continue to function after EOL, Umbraco "strongly advise [s] against using Umbraco 13 after December 14, 2026." Projects on Umbraco Cloud follow the same timeline. (umbraco.com)

The practical consequences of running past EOL:

• No security patches. Any CVE disclosed after December 2026 affecting Umbraco 13 or its dependencies goes unpatched.
• No official support. Umbraco HQ will not accept support cases for version 13.
• Compliance exposure. Auditors and cyber-insurance underwriters treat unpatched software as a material risk. PCI-DSS, SOC 2, and ISO 27001 controls all require timely patching of known vulnerabilities.
• Ecosystem drift. Hosting providers, NuGet packages, and third-party integrations will progressively drop support for .NET 8 and Umbraco 13.

The hidden clock: .NET 8 and .NET 9 end of support on 10 November 2026

Umbraco 13 runs on .NET 8. Microsoft has confirmed that .NET 8 reaches end of support on 10 November 2026 — 34 days before Umbraco 13's own EOL date. .NET 9, a Standard-Term Support release, ends on the same day. (dotnet.microsoft.com)

After 10 November 2026, Microsoft ships no further security updates for the .NET 8 runtime, ASP.NET Core 8, or the base class libraries. Your Umbraco 13 site will still execute, but the Kestrel web server, Entity Framework Core data access layer, and all core .NET libraries will be entirely unsupported.

The practical risk is not abstract. Runtime-level vulnerabilities that have historically affected .NET applications include HTTP request parsing bugs in Kestrel (CVE-class: denial-of-service, request smuggling), TLS stack vulnerabilities in System.Net, and memory corruption issues in the garbage collector or base class libraries. These differ from CMS-layer CVEs (authentication bypass, XSS in the backoffice, SSRF in media handling) in that they affect the execution environment itself — not the application code running on top of it. After 10 November 2026, any vulnerability in this category discovered in .NET 8 receives no patch from Microsoft.

This creates a compounding risk. Even if you purchase Umbraco XLTS (which covers Umbraco-level patches), the underlying .NET 8 runtime itself will not receive fixes from Microsoft. Microsoft does not sell a paid support extension for .NET — the only supported path forward is upgrading to .NET 10 LTS, which ships with Umbraco 17.

Upgrading the runtime without upgrading the CMS is not a viable option. Umbraco versions are tightly coupled to specific .NET target frameworks. Moving to .NET 10 requires upgrading the entire Umbraco application layer.

Option 1: Buy Umbraco XLTS — the runway no other CMS vendor offers

Extended Long-term Support (XLTS) is a paid programme from Umbraco HQ that delivers security and compliance patches for an Umbraco LTS version after its official EOL date. XLTS is available in 6, 12, or 24-month blocks, with coverage beginning the day after EOL. Patches are delivered through a secure, private NuGet feed. Coverage must be continuous — you cannot skip a period and resume later. (umbraco.com)

What XLTS covers

• Security patches for the Umbraco 13 CMS core
• Compliance alignment — the patches keep you demonstrably supported at the CMS layer for audit purposes during the XLTS window

What XLTS does not cover

• No new features. The feature set is frozen at the last Umbraco 13 release. The backoffice remains AngularJS-based.
• No .NET 8 runtime patches. Microsoft's support for .NET 8 ends independently on 10 November 2026. XLTS does not extend the .NET lifecycle. Runtime-level CVEs discovered after that date receive no fix from either Microsoft or Umbraco HQ.
• No package upgrades. Third-party packages that drop .NET 8 support will not be backported.
• Manual application required. XLTS patches are distributed via a private NuGet feed. Your team must pull the packages, run regression testing, and deploy to staging and production.
• Umbraco Cloud: automated vs. manual patching. For self-hosted sites, applying XLTS patches is a manual NuGet update and deployment cycle. For Umbraco Cloud-hosted sites, clarify with Umbraco HQ whether XLTS patches are applied automatically or still require a manual trigger — the documentation does not state this explicitly, and the operational difference is significant for teams without a dedicated deployment pipeline.

XLTS cost modeling

Umbraco does not publish XLTS pricing — you must contact Umbraco HQ or an Umbraco partner for a quote. However, a useful decision anchor: the cost of XLTS for 6–12 months is almost certainly lower than the cost of an emergency upgrade executed under hard-deadline pressure in Q4 2026. A planned upgrade with adequate lead time typically costs $8,000–$30,000+ depending on complexity (detailed below). An upgrade compressed into four weeks with a December deadline will cost more in engineering time, testing shortcuts, and post-launch fixes. XLTS purchases you the time to avoid that scenario. Get the quote early and model it against your upgrade estimate.

When XLTS is the right call

• Your upgrade budget is approved but not available until Q1 or Q2 2027.
• Your site is in maintenance mode with no active development and low change velocity.
• You need vendor-backed compliance coverage at the CMS layer while a larger replatforming project is scoped.
• You are running multiple Umbraco 13 sites and cannot upgrade all of them before December.
• A competing project — ERP rollout, redesign, merger programme — is consuming the same engineering team.

When XLTS is the wrong call

• You treat it as a permanent solution. XLTS maxes out at 24 months (December 2028). After that, you are unequivocally unsupported at every layer.
• Your site has active feature development. Frozen features and a frozen framework mean your developers are working in a dead-end environment.
• You are relying on XLTS to cover the runtime risk. It does not. Write down explicitly how long you are accepting .NET 8 runtime exposure and what triggers your exit.

Option 2: Upgrade to Umbraco 17 LTS

Umbraco 17 is the current Long-Term Support release. It was released on 27 November 2025, runs on .NET 10 LTS, and will be supported until 27 November 2028. Microsoft supports .NET 10 until November 2028, so the CMS and runtime support windows align — the stacked-support problem disappears. For teams committed to staying on Umbraco, this is the target. (umbraco.com)

Umbraco supports a direct LTS-to-LTS upgrade from 13 to 17 — database migrations are applied automatically, and you do not need to hop through versions 14, 15, or 16. But "direct" does not mean "trivial." The jump crosses four major versions and a complete backoffice rewrite. (umbraco.com)

A note on version targeting: If your goal is maximum supported runway, Umbraco 18 is an STS release ending 25 June 2027 — not a viable long-term target. Umbraco 19 is planned for 10 December 2026, four days before Umbraco 13 reaches EOL, so waiting for 19 provides no rescue. Umbraco 17 LTS is the correct target.

Teams on intermediate STS versions (14, 15, or 16): If you upgraded from Umbraco 13 to an STS release, you are in a separate EOL situation. Umbraco 14 ended support in September 2025. Umbraco 15 ends in June 2026. Umbraco 16 ends in December 2026. None of these are XLTS-eligible. The upgrade path to Umbraco 17 still applies, but your urgency is higher — there is no paid bridge available.

What breaks in the 13 → 17 upgrade

The most significant breaking changes stem from the backoffice overhaul introduced in Umbraco 14 (codenamed "Bellissima"):

Area	What changed	Impact
Backoffice UI	AngularJS replaced by TypeScript / Lit / Web Components	All custom property editors, dashboards, and sections must be rewritten
Content editors	Nested Content and Grid Layout removed	Must migrate to Block List and Block Grid editors
Rich text editor	TinyMCE replaced by TipTap	Schema migration runs automatically for simple content, but custom TinyMCE plugins, toolbar configurations, and stylesheets do not migrate — these require manual replacement
Macros	Macros and Partial View Macros removed	Replace with blocks in the rich text editor
Media picker	Legacy Media Picker removed	Migrate to the current Media Picker
Runtime	.NET 8 → .NET 10	Retarget, recompile, verify all NuGet dependencies
Backoffice controllers	UmbracoAuthorizedApiController and UmbracoAuthorizedJsonController removed	Migrate to Management API base classes
Third-party packages	Package authors must release v17-compatible versions	Audit every installed package before upgrading — this is the most common hard blocker

On the TinyMCE → TipTap migration specifically: Umbraco runs a data migration that converts stored rich text content to TipTap's format. For sites using default TinyMCE configuration with standard content, this typically works. For sites using custom TinyMCE plugins, non-standard toolbar configurations, custom content CSS, or embedded macros, the migration requires manual review and replacement work. Do not plan around "automatic migration" without first auditing your RTE usage.

The effort varies dramatically by site. A stock Umbraco 13 site with no custom backoffice code, no Grid or Nested Content usage, and packages that have confirmed v17 releases is a straightforward upgrade. A site with custom AngularJS dashboards, Grid-heavy content models, custom TinyMCE plugins, and external integrations is a fundamentally different project.

Package compatibility: the most common hard blocker

Third-party package support for Umbraco 17 varies. Before committing to an upgrade timeline, audit every installed package against the package author's release notes or NuGet history. Key packages to check:

• uSync — check the Jumoo GitHub releases for v17 compatibility
• Umbraco Forms — verify your licence tier covers the target version
• Contentment — historically lags major backoffice changes
• SEOChecker / SEO tools — varies by vendor
• Any package wrapping a custom AngularJS backoffice extension — these are categorically incompatible until rewritten

A package with no v17-compatible release is a hard blocker unless you are willing to fork, replace, or remove it. This is the audit step most upgrade plans skip and most upgrade postmortems cite.

Estimating cost and effort

The cost driver is not page count — it is the number and complexity of custom backoffice extensions, deprecated editor usage (Grid, Nested Content), custom TinyMCE configuration, and third-party packages without v17 support.

Site profile	Indicators	Estimated cost range
Basic	Stock backoffice, no Grid/Nested Content, packages all have v17 releases	$8,000–$15,000
Moderate	Some custom dashboards or property editors, limited Grid usage, most packages supported	$15,000–$25,000
Complex	Custom AngularJS extensions, Grid-heavy content, custom TinyMCE plugins, packages without v17 support, live integrations	$25,000–$40,000+

These ranges are based on published developer pricing frameworks in the Umbraco community and reflect planned upgrades with adequate lead time. Compressed timelines increase cost. Umbraco itself describes a second pattern for heavily customised sites: build a fresh Umbraco 17 solution and move content and schema rather than forcing an in-place upgrade. (umbraco.com)

Pre-upgrade checklist

1. Audit installed packages. Check whether every package has a v17-compatible release. This is the single biggest blocker.
2. Inventory custom backoffice code. Any AngularJS extension must be rewritten in TypeScript/Lit.
3. Identify Nested Content, Grid, and Macro usage. Plan the content model migration to Block List / Block Grid.
4. Audit TinyMCE configuration. Custom plugins, toolbars, and stylesheets require manual replacement — they do not migrate automatically.
5. Set up a .NET 10 staging environment. Verify hosting infrastructure supports the new runtime.
6. Run the upgrade on a copy of production data. Umbraco handles database migrations automatically, but validate the output.
7. Regenerate ModelsBuilder models. Delete old generated models and let the v17 backoffice regenerate them.

Option 3: Replatform to a different CMS

Some teams will decide that a forced upgrade is the right moment to re-evaluate the CMS entirely. This is a legitimate path, but it is a fundamentally different project from an Umbraco version upgrade — different in scope, cost, timeline, and risk.

An Umbraco 13-to-17 upgrade is a framework retarget and backoffice modernisation of an existing application. The content model, database, and front-end templates largely survive (with modifications). Typical timeline: weeks to a few months depending on complexity.

A replatform is a full CMS migration. Content must be extracted, transformed, and loaded into a new system. Templates are rewritten. Integrations are rebuilt. URL structures, SEO signals, and workflows must be preserved. Typical timeline: months. Do not begin a replatform under deadline pressure without a parallel safety net (XLTS) in place.

When replatforming makes sense

• You have been unhappy with Umbraco as a platform and the EOL is the trigger, not the cause.
• Your site's architecture has drifted so far from Umbraco's intended model that upgrading would effectively be a rebuild anyway.
• Your organisation is consolidating onto a different technology stack — moving away from .NET entirely.
• The business wants a different hosting or operating model: SaaS, headless-first delivery, or omnichannel content distribution.
• The wider programme already includes redesign, information architecture, or integration consolidation.

When replatforming is a mistake

• You are choosing a new CMS under deadline pressure without a proper evaluation. The EOL date is a reason to act; it is not a reason to make a bad platform decision.
• Your team is experienced with Umbraco and your content model is well-structured. An upgrade preserves that investment; a replatform discards it.

How to decide: a comparison of all three options

CMS vendor EOL options compared

	Umbraco 13	Kentico Xperience 13	Drupal 10
EOL date	14 December 2026	31 December 2026	9 December 2026
Paid post-EOL extension	Yes — XLTS (6/12/24 months, first-party)	No	Partial — third-party Vendor Extended Support, not first-party
Runtime EOL	.NET 8: 10 November 2026	.NET 8: 10 November 2026	PHP varies by version
Recommended upgrade path	Umbraco 17 LTS (.NET 10)	Xperience by Kentico (architectural reimplementation)	Drupal 11
Upgrade complexity	High (backoffice rewrite)	Very high (full reimplementation)	Moderate

Kentico Xperience 13 also reaches end of life in December 2026, but Kentico does not sell an XLTS equivalent. After 31 December 2026, all support ceases entirely, and Kentico states that continued use is "at your sole risk." (kentico.com) The Kentico-to-Xperience path is a full architectural reimplementation, not a version upgrade. Drupal 10 reaches EOL on 9 December 2026, and while the Drupal Association set up a Vendor Extended Support programme, it routes through third-party providers rather than being a first-party service — quality, pricing, and scope vary by vendor.

Umbraco's XLTS — first-party, vendor-operated, available in 6/12/24-month blocks — buys structured runway that these other CMS vendors do not offer. The .NET 8 runtime gap remains in all cases where XLTS is chosen, but the CMS-layer bridge is real.

XLTS vs. upgrade vs. replatform: decision matrix

The decision depends on three variables: time to deadline, budget availability, and strategic intent.

Scenario	Recommended path
Budget approved, team available, no custom backoffice blockers	Upgrade to Umbraco 17 before December 2026
Budget approved but timeline is tight (Q4 2026 start)	Buy 6-month XLTS as insurance, begin upgrade immediately
Budget not available until 2027	Buy XLTS to bridge the gap, lock in the upgrade plan
Site in maintenance mode, no active development	Buy XLTS (12 or 24 months), evaluate whether to upgrade or sunset
Strategic decision to leave Umbraco	Buy XLTS while scoping the replatform — do not rush a CMS selection under deadline pressure
Heavy custom backoffice, Grid content, packages without v17 support	Start the upgrade now — this is the hardest path and needs the most lead time
On STS versions 14, 15, or 16	Upgrade to 17 — no XLTS available for these versions

Regardless of path, start scoping at least 3–4 months before any internal deadline. An upgrade that starts in November 2026 with a December deadline is a recipe for corners cut and bugs shipped.

Umbraco Cloud: the End-of-Service timeline

For sites hosted on Umbraco Cloud, the timeline extends slightly beyond pure EOL. Umbraco's End-of-Service policy for version 13 projects: (docs.umbraco.com)

• EOL (14 December 2026): Security patches stop unless you have an XLTS contract.
• End of XLTS (14 December 2028 at latest): Projects are moved from shared to dedicated hosting.
• Dedicated hosting ends (14 December 2029): Hosting is discontinued unless the project has been upgraded.

An XLTS contract is not required to keep your site hosted on Umbraco Cloud after EOL — but without one, you receive no security patches during that period. Umbraco moves projects to dedicated hosting after the XLTS window specifically to isolate unsupported software from the shared environment.

Operational note for Cloud-hosted sites: The documentation does not clearly state whether XLTS patches are applied automatically for Cloud-hosted projects or whether they require a manual trigger equivalent to a self-hosted NuGet update. Confirm this with Umbraco HQ before purchasing — for teams without a dedicated deployment pipeline, the difference between automatic and manual patching is operationally significant.

The technical reality of extracting Umbraco data

Whether you upgrade to Umbraco 17 or replatform to a different CMS, the content migration deserves its own planning track.

Umbraco stores content in a SQL Server (or SQLite) database. An in-place upgrade preserves this schema and runs migrations automatically. A replatform requires extracting it.

Extraction from Umbraco 13 is technically complex. Modern Umbraco heavily utilises JSON to store complex layouts — Block Grid and Nested Content data lives inside single relational columns (cmsPropertyData) as nested JSON arrays. Generic migration scripts that pull raw database rows cannot parse these nested structures to extract actual text, image references, and structural hierarchies. The content tree relationships stored in umbracoContentVersion and the property data stored in cmsPropertyData must be reconstructed together to produce meaningful output for a target system.

Keep two clocks separate when planning a replatform. The first clock measures your internal rebuild: selecting a new CMS, designing the architecture, writing templates, and rebuilding integrations. That effort runs for months. The second clock measures the data migration: moving your content, media, taxonomies, and metadata from Umbraco 13 to the new system. These two workstreams have different owners, different tooling, and different completion criteria — conflating them is one of the most common replatform planning errors.

Most data migrations complete within 1–5 business days, depending on volume, complexity, and target API rate limits. By volume:

• 1–500 documents: 1–2 days
• 500–5,000 documents: 3–7 days
• 5,000+ documents: Custom engagement — usually an initial bulk migration followed by delta syncs, running 7–13+ business days depending on target API rate limits, Umbraco JSON block complexity, and validation availability

The extraction method matters. Direct database queries against the Umbraco schema can reconstruct the correct content tree and property data. The Umbraco Content Delivery API provides a structured JSON representation that is safer for teams without direct database access. CSV exports from the Umbraco backoffice destroy hierarchical relationships and should not be used for migrations where content structure must be preserved.

At ClonePartner, our transfer preference is API > direct database extraction > CSV for exactly this reason. We extract content via the Umbraco Content Delivery API or by querying the database directly, validate output through record-count parity checks, field-level validation, and referential integrity checks on media picker references and taxonomy tags, and perform a background sync process that keeps your Umbraco 13 source operational until cutover. We charge one fixed price per project starting at $500 — no hourly billing, no per-record metering. A free 30-minute scoping call produces a fixed-price proposal.

A timeline for teams starting now

Immediately:

• Audit your site: count custom backoffice extensions, Grid/Nested Content usage, custom TinyMCE configuration, third-party packages without confirmed v17 support, and media volume.
• Contact Umbraco (or your Umbraco partner) for an XLTS quote. Get the number early so you can model it against upgrade cost.
• Determine whether your .NET 10 hosting environment is ready.

By November 2026:

• If upgrading: have a staging environment on Umbraco 17 / .NET 10 with production data loaded. Run the upgrade, validate, fix breaking changes.
• If buying XLTS: have the contract in place before 14 December. Coverage begins the day after EOL with no gaps allowed.

By 14 December 2026:

• Either your production site is on Umbraco 17, or your XLTS coverage is active.

Q1 2027 and beyond (XLTS path):

• Begin the upgrade or replatform project with the deadline pressure removed. Define a specific milestone that ends your .NET 8 runtime exposure.

What happens if you do nothing

Your site keeps running. Umbraco has been explicit — EOL does not shut sites down. But running an unpatched CMS on an unpatched runtime is a compounding risk, not a static one. Every month post-EOL, the probability of an unpatched vulnerability being exploited increases. The risk profile compounds because both vectors — CMS-layer CVEs and runtime-layer CVEs — accumulate simultaneously with no patches available for either.

Compliance audits become harder to pass. Cyber-insurance renewals may include exclusions for unsupported software or require attestation that all production components are under active vendor support. The cost of eventually upgrading only grows as the gap between your version and the current release widens.

The .NET 8 runtime EOL on 10 November 2026 accelerates this. It is not just Umbraco that stops getting patches — it is the entire execution environment: the web server, the TLS stack, the data access libraries.

Do not frame this as "can the site keep running." It probably can. The real question is whether you want an unpatched CMS running on an unpatched runtime on your production risk register, and whether your compliance posture, cyber-insurance terms, and customer agreements permit it.

If you cannot finish in time, XLTS is a rational bridge — it covers the CMS layer with a defined exit. If you are staying on Umbraco, 17 LTS is the default stable target with aligned CMS and runtime support through November 2028. If the team is already questioning the CMS, the operating model, or the codebase direction, replatforming is more honest than pouring effort into an upgrade you do not want — but buy XLTS first so you are not making a platform decision under deadline pressure.

For the broader 2026 deadline stack, see our complete EOL calendar and Microsoft 2026 support guide.