.NET 8 and 9 end of support on 10 November 2026: .NET 10 or .NET 11?

Summary. .NET 8 and .NET 9 reached end of support on 10 November 2026, the same Patch Tuesday on which Microsoft shipped .NET 11. The final patches are 8.0.34 (SDK 8.0.428) and 9.0.23 (SDK 9.0.321). The 8.0.34 notes list 17 CVEs, including CVE-2026-118741 (CVSS 8.1), an Identity scaffolding flaw that a runtime update cannot fix: generated code has to be corrected and redeployed. Nothing switches off, but fixes shipped from the next Patch Tuesday, 8 December 2026, will not reach 8.0 or 9.0, and Azure App Service no longer patches or supports those stacks. The Azure Functions in-process model, which by then ran only .NET 8, lost support the same day. Both destinations end together: .NET 10 (LTS, now 10.0.15) and .NET 11 (STS, 11.0.0) are supported until 14 November 2028, because Microsoft moved STS releases to 24 months starting with .NET 9. So the choice is about risk, not runway. .NET 10 has 15 patch releases behind it and one fewer breaking-change list to absorb. .NET 11 adds C# 15 union types but raises the x86/x64 hardware floor and moves .NET MAUI mobile apps to CoreCLR. Our verdict: install the final patches now, move Functions to the isolated worker, then retarget most production apps to .NET 10.

About this article. For engineering leads, architects and platform teams still running .NET 8 or .NET 9. We checked every date, version and CVE on 11 November 2026 against Microsoft's .NET support policy and release metadata, the .NET Blog, the dotnet/core release notes, the CVE-2026-118741 advisory, Microsoft Learn pages for Azure Functions, App Service and .NET 11, and CISA's Known Exploited Vulnerabilities catalogue. Microsoft revises these pages often, so re-check versions before you commit a plan; no vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

What changed on 10 November 2026

Microsoft's .NET and .NET Core support policy page now carries a last-updated date of 10 November 2026, and the machine-readable release index matches it. The rows that matter:

Three details in that table drive the plan.

The last patches carry a lot. .NET 8.0.34, shipped with SDKs 8.0.428 and 8.0.134, lists 17 CVEs: nine in ASP.NET Core, three in the .NET runtime and libraries, and five with Visual Studio remote code execution titles. 9.0.23 lists 16; the one it lacks, CVE-2026-109478, is listed for .NET 8 only. Two of them need more than a runtime install:

• CVE-2026-118741 is an elevation-of-privilege flaw in the ASP.NET Core Identity scaffolding and templates. Generated password-reset and email-confirmation handlers send mail to the address supplied in the request instead of the one stored on the account. Microsoft rates it 8.1 (High), and the advisory's CVSS vector marks exploit maturity as unproven. Fixed versions are the code generator packages 8.0.24, 9.0.13 and 10.0.3, the web project templates 8.0.34, 9.0.23 and 10.0.15, and the Microsoft.dotnet-scaffold tool 20.3.0. Updating any of these does not repair apps you already generated: change the ForgotPassword and ResendEmailConfirmation handlers to use the stored address, then rebuild and redeploy.

• CVE-2026-118747, a denial-of-service issue, also needs the System.Formats.Cbor NuGet package updated. On the .NET 9 line the fixed package is 9.0.24, so installing runtime 9.0.23 alone does not close it.

Two weeks earlier, on 25 October, Microsoft shipped out-of-band updates (8.0.33, 9.0.22 and 10.0.14) for CVE-2026-111497, a buffer overflow in .NET's use of Brotli decompression, and CVE-2026-114148, unsafe ownership metadata in Linux tarballs. CISA added the Brotli flaw to its Known Exploited Vulnerabilities catalogue on 27 October with a federal due date of 10 November. None of the November .NET CVEs was in the catalogue's 10 November edition when we checked. Our Brotli CVE-2026-111497 patch guide covers the other products that embed that decoder. A .NET 8 estate that skipped recent patching is not just out of support; it is missing a cluster of late fixes.

The two destinations expire together. The policy gives LTS releases three years and STS releases two. STS used to mean 18 months, and .NET 9 was originally due to end on 12 May 2026. In September 2025 Microsoft extended STS to 24 months starting with .NET 9, which is why .NET 8 and 9 ended on the same day, and why .NET 11 now ends on the same day as .NET 10.

Some documentation still lags. The policy, release index and release notes all show 11.0.0 and the final 8.0 and 9.0 patches. On 11 November, Microsoft Learn's What's new in .NET 11 overview still said it was last updated for release candidate 2, and the .NET 11 breaking-change list is marked as incomplete. Treat the .NET 11 announcement and the release notes as the current record.

What out of support means in practice

The runtime does not switch off. A .NET 8 or 9 application keeps running today and after. What stops is everything around it.

1. No more security fixes. Microsoft ships .NET updates on Patch Tuesday, the second Tuesday of each month, though not every Patch Tuesday brings a .NET release. The next one is 8 December 2026. Whatever Microsoft fixes in .NET 10 and 11 from then on will not be built for 8.0 or 9.0, and the policy warns that out-of-support versions can put applications, data and the wider computing environment at risk.

1. No Microsoft support. The policy defines end of life as the point when Microsoft stops providing fixes, updates and online technical assistance. Expect a support case about a .NET 8 crash to start with a request to upgrade.

1. No automatic patching. Supported versions on Windows can be patched through Microsoft Update, which only helps framework-dependent apps. Self-contained deployments always carried their own runtime, and that bundled runtime is now frozen at whatever you last published.

1. Azure stops covering the stack. App Service's runtime policy says apps on an end-of-support language version continue to run unchanged, but App Service cannot provide security patches or related support for that runtime, and you must move to a supported version before App Service support will help.

1. No paid extension. The .NET policy describes no extended security update programme for .NET 8 or 9. Its advice is to move to a newer version and to uninstall versions you no longer use.

The risk is uneven across a portfolio. An internet-facing ASP.NET Core API that parses untrusted input carries far more exposure than a nightly batch job on a private network. Rank apps by exposure, not by codebase size, and patch everything to 8.0.34 or 9.0.23 now so the unpatched gap starts as small as possible.

.NET 10 LTS or .NET 11 STS?

With identical end dates, the trade-off is maturity against features. The table below draws on the support policy, the .NET 11 announcement, Microsoft Learn's hardware note and the Azure Functions versions page.

The Visual Studio row comes from Microsoft's SDK versioning table: SDK 10.0.100 ships with Visual Studio 18.0 (Visual Studio 2026), and the oldest release it works with, 17.14, can target only up to net9.0. Our Visual Studio 2022 end of mainstream support guide covers that move. If C# 15 is the draw, our C# union types and .NET 11 migration guide shows how to adopt unions without boxing on hot paths.

How to choose

Whichever you pick, budget for the next move. Microsoft publishes a major release every November and even-numbered releases are LTS, so if that cadence holds, the next LTS arrives in November 2027. Neither .NET 10 nor .NET 11 is a five-year home.

Breaking changes to budget for

Microsoft publishes a breaking-change list for every release and marks the .NET 11 list as a work in progress. The items most likely to affect server teams:

• Minimum hardware. .NET 11 raises the x86/x64 baseline from x86-64-v1 to x86-64-v2 on Windows, Linux and macOS, adding CX16, POPCNT, SSE3, SSSE3, SSE4.1 and SSE4.2 to the guaranteed set. On older CPUs it fails to start and reports missing baseline instruction sets. Microsoft says the last chips without these went out of vendor support around 2013, but check on-premises servers and any VM cluster that presents a reduced CPU feature set. ReadyToRun code now targets x86-64-v3 on Windows and Linux, so CPUs without AVX2 may spend extra start-up time in the JIT.

• Hosting behaviour. IHost.RunAsync and IHost.StopAsync now throw when a BackgroundService fails, which changes how worker services exit and what orchestrators see.

• Configuration. Empty strings in chained configuration now override earlier providers, so an empty environment variable can blank a value that appsettings.json used to supply.

• Parsing and maths. The DateOnly and TimeOnly TryParse methods now throw for some invalid input (read the note for the exact cases), and Math.Round and MathF.Round return correctly rounded results. Financial and reporting code deserves a regression run.

• Unix behaviour. Named mutexes default to user scope, and NamedPipeServerStream with CurrentUserOnly tightens socket file permissions. Linux apps that share a mutex across users need a look.

• TLS and crypto. Server-side SslStream no longer downloads AIA certificates by default, Linux AIA fetching is capped at two fetches per chain build, and DSA is removed on macOS.

• SDK and restore. Restore no longer searches the global packages folder for a higher version, which can expose missing packages in offline or cached CI builds.

• .NET MAUI. CoreCLR replaces Mono for mobile apps, Android x86 is not supported, and the minimum Android API level rises to 24. .NET MAUI also follows its own support policy, separate from the runtime's LTS and STS dates.

Going from .NET 8 to .NET 10 skips the .NET 11 list entirely, which is the strongest practical argument for the LTS hop in large estates.

Azure App Service and Azure Functions: the dates that matter

Many .NET workloads on Azure run on App Service or Functions. The table below comes from Microsoft Learn's Functions runtime versions page and the App Service language runtime policy.

Three practical consequences follow.

Functions upgrades are two projects, not one. The in-process model supports only .NET 8, so you cannot retarget an in-process app to .NET 10 where it stands. Move to the isolated worker first, deploy, then change the target framework. The worker change touches bindings, start-up and logging code, so test it as its own release; Microsoft's isolated-model migration guide, linked from the versions page, is the starting point.

Linux Consumption is a dead end for new .NET versions. Microsoft says newer .NET versions are not being added to Linux Consumption, so an app on that plan needs a hosting change to Flex Consumption before it can run .NET 10. Price that move now rather than discovering it during cutover.

App Service notices may have missed your engineers. App Service sends end-of-support reminders to subscription owners, account administrators, service administrators and co-administrators. Contributors and readers get them only if they opt in through Service Health alerts. The App Service team blog had not announced a built-in .NET 11 stack when we checked on 11 November, so confirm the available stacks before planning a .NET 11 deployment. Until one appears, the fallback is a custom container, which App Service's policy recommends whenever you need a specific runtime version.

Upgrade plan

A sequence that works for a portfolio of ten apps or a hundred.

Day 0: close what you can today

            # What is installed on each build agent and server
dotnet --list-sdks
dotnet --list-runtimes

# Which projects still target .NET 8 or 9 (props files can set it too)
grep -rlE "<TargetFrameworks?>.*net(8|9)\.0" --include="*.csproj" --include="*.props" .

# Which container images still pull 8.0 or 9.0 base images
grep -rE "mcr\.microsoft\.com/dotnet/[a-z-]+:(8|9)\.0" --include="Dockerfile*" .
          

Install 8.0.34 or 9.0.23 on every host. Rebuild and republish self-contained apps and container images so they carry the final runtime, because a newer runtime on the host does not update one bundled inside an app. If any app was generated from ASP.NET Core Identity templates, apply the CVE-2026-118741 handler repair, and update System.Formats.Cbor wherever you reference it.

Weeks 1 to 2: inventory and decide

For each app, record the target framework, hosting (App Service, Functions in-process or isolated, containers, IIS, VMs), exposure (internet-facing or internal), test coverage and owner. Apply the decision table above. Flag every Functions app on the in-process model or the Linux Consumption plan, because those need hosting work before the runtime change.

Weeks 2 to 6: retarget

1. Pin the SDK. Add a global.json so local builds and CI resolve the same SDK. The example below accepts 10.0.404 or a later patch in the 10.0.4xx feature band, and nothing else.

1. Change the target framework to net10.0 (or net11.0), and move Microsoft.*, Entity Framework Core and ASP.NET Core packages to the matching major version.

1. Use the supported tooling. Microsoft Learn marks the .NET Upgrade Assistant as officially deprecated (page last updated 19 March 2026) and points to the GitHub Copilot modernization chat agent in Visual Studio 2026 and Visual Studio 2022 17.14.16 or later. It produces a step-by-step plan and commits each change, which suits code review. Treat its output like any other pull request.

1. Run the breaking-change checklist above, plus Microsoft's lists for every release you skip.

1. Run characterisation and performance tests against the old build first, so you have a baseline to compare with.

            {
  "sdk": {
    "version": "10.0.404",
    "rollForward": "latestPatch"
  }
}
          

Weeks 4 to 8: deploy and clean up

Deploy through staging with a rollback path, switch App Service stacks or container base images, and watch error rates, memory and start-up time for a full business cycle. Then uninstall the .NET 8 and 9 runtimes from servers that no longer need them, as the support policy recommends, so nothing quietly falls back to them.

Where .NET Framework fits

None of this changes .NET Framework 4.8. From version 4.5.2 onward, .NET Framework is a component of Windows and follows the lifecycle of the Windows version it is installed on, so a Web Forms or WCF application did not lose support on 10 November. The deadline applies to modern .NET, the former Core line. Our .NET development company guide explains which Framework technologies have no modern equivalent, and our Windows Server 2016 end-of-support playbook covers the operating system clock under those apps.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our application development services team plans and runs .NET runtime upgrades, from final-patch rollout and Azure Functions moves to the isolated worker through retargeting and regression testing against a baseline. Talk to us at /contact-us/.

Last updated: 11 November 2026.

References

1. .NET and .NET Core Support Policy, last updated 10 November 2026 — Microsoft

1. .NET release metadata index — Microsoft

1. .NET 8.0.34 release notes, 10 November 2026 — dotnet/core on GitHub

1. Microsoft Security Advisory CVE-2026-118741, ASP.NET Core Elevation of Privilege Vulnerability — dotnet/announcements on GitHub

1. Language runtime support policy for Azure App Service — Microsoft Learn

1. Compare Azure Functions runtime versions — Microsoft Learn

1. .NET STS releases supported for 24 months, 16 September 2025 — .NET Blog

1. .NET 9.0.23 release notes, 10 November 2026 — dotnet/core on GitHub

1. .NET and .NET Framework November 2026 servicing updates, 10 November 2026 — .NET Blog

1. .NET October 2026 Out-of-Band Security Updates, 25 October 2026 — .NET Blog

1. Known Exploited Vulnerabilities Catalog, JSON feed, version 2026.11.10 — CISA

1. What's new in .NET 11 — Microsoft Learn

1. Breaking changes in .NET 11 — Microsoft Learn

1. Announcing .NET 11, 10 November 2026 — .NET Blog

1. Breaking change: minimum hardware requirements updated (.NET 11) — Microsoft Learn

1. .NET SDK, MSBuild and Visual Studio versioning — Microsoft Learn

1. Azure App Service team blog — Microsoft

1. global.json overview — Microsoft Learn

1. What is .NET Upgrade Assistant? — Microsoft Learn

1. Lifecycle FAQ: .NET Framework — Microsoft Learn