VCF 5.2 end of support on 11 October 2027: NSX 4 and Aria 8 to VCF 9.1 checklist

Summary. Broadcom knowledge base article 456708 sets 11 October 2027 as the end of service for VMware Cloud Foundation (VCF) 5.2.x, NSX 4.x, Aria Automation, Aria Operations and Aria Operations for Logs 8.18.x, Aria Operations for Networks 6.x, HCX 4.x and VMware Identity Manager 3.3.7, the same day as ESXi, vCenter and vSAN 8.x. After that date there is no technical support and there are no new patches. Broadcom points customers to VCF 9 or vSphere Foundation (VVF) 9, but its 9.1 component list places NSX Manager, NSX Edge, VCF Automation, VCF Operations for networks and HCX on VCF only. The current release is 9.1.1, generally available since 3 September 2026, and a 5.2 estate can upgrade to it directly. The order is strict: Aria Operations becomes VCF Operations, then SDDC Manager, the new VCF management services and licence server, and only then NSX, vCenter and ESX. Aria Suite Lifecycle, Aria Operations for Logs and Identity Manager have no upgrade path. NSX needs Manager-mode objects promoted to Policy, multi-NSX switched off and service accounts on every compute manager. Licensing is subscription only, per physical core with a 16-core minimum per CPU. From 11 November 2026, 334 days remain, so run the prechecks before the end of December 2026.

About this article. This checklist is for teams running VCF 5.2, or standalone NSX 4.x and Aria 8.x next to vSphere 8. On 11 November 2026 we checked lifecycle dates, upgrade order, prechecks and licensing rules against Broadcom knowledge base articles, Broadcom TechDocs for VCF 9.1, the VMware Cloud Foundation blog and Broadcom's VCF 9.1 FAQ dated 8 November 2026. We found no public Broadcom list price for VCF or VVF, so none appears here. This is general information, not licensing or contractual advice, and no vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

For the vSphere-level view, including CPU cut-offs and a back-planned timeline, read our vSphere 8 end of support and VCF 9.1 upgrade guide. If the renewal quote makes staying unattractive, our VMware alternatives comparison sets out six exits.

What ends on 11 October 2027, and what replaces it

Dates come from KB 456708 and KB 459135, which records vSphere 8 as released on 11 October 2022. The 9.1 names come from Broadcom's component mapping.

Cloud Director 10.6.2 and Cloud Director Availability 4.7.6 run to 12 August 2028. VVF for VDI follows its own lifecycle, and Broadcom had announced no end date for it as of February 2026. SDDC Manager keeps its name, but Broadcom is deprecating its user interface; after the upgrade, lifecycle work moves to VCF Operations.

What changed in 2026 for NSX and Aria estates

1. VCF 9.1 shipped, then 9.1.1. Broadcom dates VCF 9.1.0 to 12 May 2026 and 9.1.1 to 3 September 2026. Patch releases for the 9.1.1 line followed on 21 September, 12 October and 26 October 2026. You can go straight to 9.1.1 without passing through 9.1.0.

1. Two new mandatory components. VCF management services is a container runtime that hosts fleet lifecycle, SDDC lifecycle, the software depot, log management and the identity broker. The second is a headless licence server appliance.

1. Aria Suite Lifecycle lost its job. Fleet lifecycle and SDDC lifecycle replace it; Broadcom says to keep the old instance only for Identity Manager 3.3.x tasks.

1. Logs content packs reached end of general support in 9.1. Third-party packs must be converted into VCF Operations management packs.

1. Compliance was repackaged. The VCF Operations compliance feature is deprecated in favour of Security Posture Management. Broadcom's FAQ of 8 November 2026 says Advanced Cyber Compliance customers keep it until their entitlement ends, then can buy VMware Live Recovery and the VMware Compliance and Configuration Management add-on.

1. NSX Federation is supported in 9.1, and convergence accepts vCenter instances whose NSX Local Managers belong to a Federation; only the Local Manager is converted.

1. Data Services Manager moved into Broadcom's TrueSource data services family on 4 November 2026.

Licensing to settle before you touch anything

What VCF 9 covers. Broadcom's FAQ lists vCenter, ESX, vSAN, NSX, HCX, VCF Operations, VCF Automation, vSphere Kubernetes Service and VCF Private AI Services. Avi Load Balancer, vDefend Firewall and VMware Live Recovery are licensed separately. That matters for NSX firewall users: Broadcom no longer accepts pre-version 9 licences for NSX security features, which run in evaluation mode for 90 days after the upgrade unless a vDefend licence is assigned.

What VVF lacks. Broadcom's 9.1 component table marks NSX Manager, NSX Edge, VCF Automation, VCF Operations for networks and VCF Operations HCX as VCF only. A VVF target means giving up NSX overlay networking and rebuilding any Aria Automation catalogue elsewhere.

Counting cores. KB 313548 requires at least 16 physical cores licensed per CPU. VCF includes 1 TiB of vSAN per core and VVF 0.25 TiB, rounded up. Count with every core active, because cores disabled in the BIOS make Broadcom's script inaccurate.

Perpetual licences must be switched to subscription before upgrading.

During the upgrade, components run in evaluation mode and are then licensed through VCF Operations, which VCF 9 requires. VCF 5.x keys keep working for domains not yet upgraded, and sites without internet access can report usage by the disconnected method.

Worked example: counting a VCF 5.2 estate

Illustrative arithmetic, not a client case: a management domain of 4 hosts with two 12-core CPUs each, and a workload domain of 6 hosts with two 32-core CPUs each. The rules are those of KB 313548.

• Management domain: 4 × 2 × 12 = 96 physical cores, but 4 × 2 × 16 = 128 licensable.

• Workload domain: 6 × 2 × 32 = 384 cores.

• Total: 128 + 384 = 512 licensable cores against 480 physical.

• Raw vSAN: 4 × 8 TiB + 6 × 40 TiB = 272 TiB.

• VCF entitlement: 512 × 1 TiB = 512 TiB, so no add-on. VVF entitlement: 512 × 0.25 = 128 TiB, so 272 − 128 = 144 TiB of add-on, and no NSX.

With P as your quoted annual price per core, a three-year VCF term is 512 × 3 × P = 1,536P.

The VCF 5.2 to 9.1 upgrade order

Broadcom calls the sequence strict and warns that a wrong order produces errors. Start with the management domain of the VCF instance that hosts VCF Operations. Workload domains can follow later as a Day-N task, but any domain still on vCenter 8, ESX 8 and NSX 4 is unsupported after 11 October 2027.

The forward-only rule catches patched estates: you can only upgrade to a release published after your current one, and the rule covers every component in the bill of materials. Broadcom's example is that VCF 5.2.4 (27 May 2026) cannot go to 9.1.0 but can go to 9.1.1 (3 September 2026). VCF 4.x must reach 5.2 first.

The table follows Broadcom's 5.2 to 9.1 sequence. VCF Automation can be deployed as a Day-N task, and the VCF blog's walkthrough of Professional Services practice recommends upgrading Aria Automation with custom code as a separate workstream. Broadcom's VCF Upgrade Planning Tool generates a sequence for your starting versions.

NSX 4.x checklist

Clean up before the precheck finds it

Broadcom lists these in its NSX upgrade checklist.

• Manager-mode objects. VCF 9.0 removed the Manager APIs for logical networking and security. Use the Policy promotion tool in your current NSX to migrate them; NSX raises an alarm for any left after the upgrade.

• Mixed-mode configurations. If Policy and Manager objects reference each other, such as Manager NAT rules on Policy routers, upgrade to NSX 4.2.1 or later, promote there, then upgrade to VCF 9.

• Mixed-mode IP allocations. Broadcom warns that the upgrade coordinator precheck does not detect them. Find and promote them yourself.

• Grouping members. Replace IPSET with Group, Logical Switch with Segment and Logical Port with Segment Port.

• Manager IDs disappear. Where an API takes one, create the object through the Policy API and use its Unique ID.

• Multi-NSX is unsupported from 9.0. Turn it off, or map each NSX Manager to its own vCenter.

• Compute manager service accounts. Enable the create service account setting on each registered compute manager or the precheck fails.

Pre-upgrade hygiene

• Run Broadcom's Certificate Analyzer, Results and Recovery (CARR) script from KB 369034 so no NSX certificate expires within 90 days.

• Back up NSX Manager, then turn off automatic backups for the duration.

• Confirm transport node profiles include the right transport zones.

• End SSH sessions and local scripts on NSX Managers and Edges.

• Delete expired user accounts, including any in the vSphere lockdown-mode exception list, which otherwise fails the upgrade.

• Check that required ports are open from host and Edge transport nodes to NSX Manager.

How the NSX upgrade runs in 9.1

NSX is now a two-step upgrade because NSX VIBs ship inside ESX. The NSX Manager cluster goes first; Edge clusters are upgraded and NSX finalised after vCenter and ESX. You pick an optimised maintenance window (prepare the new vCenter, upgrade NSX, then switch vCenter over) or a sequential plan (NSX, then vCenter in a separate window). A shared NSX instance forces every domain using it to upgrade vCenter and ESX before you can finalise, and cancelling the plan on one dependent domain cancels it on all.

API and feature removals to test against

VCF 9.1 removes 17 NSX Manager API operations (System Health Agent metrics, port mirroring, node user listing) and 9 Policy API operations, including VPC subnet bridge profiles and PMaaS firewall exclude lists. An active IPFIX configuration on distributed switch uplink port groups or LACP ports blocks the vCenter upgrade until removed. Search scripts, Terraform and monitoring for them before the lab rehearsal.

Standalone NSX 4.x next to vSphere 8

Standalone NSX customers must converge into VCF. Broadcom's FAQ says the VCF Installer converts a vCenter 8.0 Update 3 environment running NSX 4.2 into a VCF management domain, and VCF Operations imports further vCenters with NSX 4.2 or later as workload domains, without downtime or VM migration. The TechDocs convergence page is stricter, naming NSX 4.2.1 or later, so plan on 4.2.1. Convergence rejects a vCenter with Enhanced Linked Mode plus an NSX registration, several NSX Managers on one vCenter, Cisco virtual switches, clusters on vLCM baselines, manual or partially automated DRS and vCenter High Availability. All clusters of a vCenter come in together, and by default the new management components must sit on the existing vCenter's subnet unless you choose a dedicated management network.

Aria 8.x checklist

Aria Operations 8.18 to VCF Operations 9.1

• Check the source version. The PAK upload is the only upgrade method from 8.x; a 9.1.0.x target needs Aria Operations 8.18 or later, and a 9.1.1.x target needs 8.18.6 or later. Broadcom's warning against 8.18.6 applies only to customers heading for 9.0.x.

• Snapshot every node first. The upgrade overwrites out-of-the-box dashboards, alerts, views and reports, so clone anything you edited and back it up before you start.

• Fix certificates: 9.1 rejects incomplete Subject Alternative Names for VCF Operations, VCF Automation and VCF Operations for networks.

• Place a cloud proxy in the first VCF instance. An 8.18.x proxy outside it that forwards logs to Aria Operations for Logs with a one-time key is shut down after the upgrade.

• Afterwards, remove the product from Aria Suite Lifecycle without deleting its VM.

• Expect changes: vCenter credentials no longer log in to VCF Operations, the Network Share plugin is removed because FIPS mode is always on, and the Horizon management pack has had no Broadcom support since 28 March 2025.

Aria Automation 8.18 to VCF Automation 9.1

The instance must run 8.18.1 or later and sit in the management domain of the target VCF instance. Broadcom's KB 389563 lists the configurations that should stop you.

The upgrade is blue-green: a new 9.1 instance is built while the old one keeps serving, data migrates, traffic switches and the old nodes shut down. Plan addresses now. Targets from 9.1.0.0 to 9.1.0.300 need a /29 block of 8 sequential IPs on the existing Automation network; 9.1.0.400 and later accept 5 IPs. Add one new FQDN and IP for the VCF services runtime; the user-facing FQDN carries over. Medium maps to Medium, Extra Large to Large. With several Aria Automation instances, only one integrates with VCF Operations; the rest are upgraded and patched individually. Afterwards, move authentication from Identity Manager to the identity broker.

Logs, Networks, Orchestrator, Suite Lifecycle and Identity Manager

• Aria Operations for Logs: no upgrade. Deploy log management on the management network that hosts VCF management services (a custom NSX overlay is not allowed), reconfigure agents and log sources by hand, transfer log data and convert custom content. The 9.1 logs agent no longer bundles OpenSSL and needs OpenSSL 3 or later on the host.

• Aria Operations for Networks: reach 6.14.0 Patch 6 or 6.14.1, import into VCF Operations, then upgrade; only one instance can be imported. AWS and Azure data sources are deprecated and the vCenter Assessment report is removed.

• Aria Automation Orchestrator: upgrade from 8.18.1 or later to VCF Operations orchestrator 9.1 with a mounted ISO.

• Aria Suite Lifecycle: no upgrade. Keep it only while Identity Manager 3.3.x remains.

• VMware Identity Manager 3.3.7: do not delete it until VCF Automation authentication has moved to the identity broker, because it is still an authentication source.

• HCX 4.x: after upgrading to 9.1, upgrade all paired appliances too; 9.x appliances do not pair with earlier versions.

SDDC Manager, vCenter, ESX and vSAN items that stall 5.2 upgrades

• Plan the vCenter temporary network. From 5.2 the Reduced Downtime Upgrade is the only option; its automatic setting uses a link-local address and needs no spare IP, or you can give a static IP in the management subnet.

• Check certificate and password validity and update the vSAN hardware compatibility database before the SDDC Manager precheck.

• Convert every cluster from vLCM baselines to images before upgrading ESX.

• Move syslog sent to vCenter from port 514 to TLS port 1514; vCenter 9.1 blocks 514.

• Review scripts that call SDDC Manager: 21 API operations are deprecated in 9.1, mainly edge cluster, domain overlay, DNS, NTP and upgrade precheck calls.

• Plan off vVols, deprecated from 9.0.

• Give VCF management services real DNS names: Broadcom does not accept the .local domain for their FQDNs.

Readiness gates: go or no-go for each phase

Stay on VCF, drop to VVF, or leave

The paths below follow Broadcom's component table, licensing FAQ and Cloud Director migration note.

Running NSX 4 or Aria 8 unsupported past 11 October 2027 is not a plan: both sit on the management and security path of every workload. Before signing either way, our VMware exit cost model lists what to count.

India and regulated-sector notes

We found no Broadcom rupee price list, so get core counts, vSAN TiB, vDefend and Avi lines and term in writing from your partner. Air-gapped sites can use disconnected licence reporting, but someone must own it. Convergence expects VCF management components on the existing vCenter's subnet by default, so check IP space in segmented networks early.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our data centre and cloud networking team runs the NSX promotion and KB 389563 prechecks, counts cores and vSAN TiB against Broadcom's rules, and rehearses the VCF 9.1 upgrade order in a lab before production. Talk to us at /contact-us/.

Last updated: 11 November 2026.

References

1. Upcoming End of Service for vSphere 8, vSAN 8, Aria 8, NSX 4 and VCF 5 product suite (KB 456708) — Broadcom Knowledge Base

1. Components in VCF and vSphere Foundation, VCF 9.1 — Broadcom TechDocs

1. VMware Cloud Foundation 9.1.1.0 Release Notes, 3 September 2026 — Broadcom TechDocs

1. Upgrading to VMware Cloud Foundation 9.1.x — Broadcom TechDocs

1. Manage Unsupported Features before an NSX upgrade, VCF 9.1 — Broadcom TechDocs

1. Counting Cores for VMware Cloud Foundation and vSphere Foundation and TiBs for vSAN (KB 313548) — Broadcom Knowledge Base

1. End of General Support for vSphere 8.0 (KB 459135) — Broadcom Knowledge Base

1. VVF for VDI Lifecycle Support (KB 428674) — Broadcom Knowledge Base

1. Correlating VMware Cloud Foundation version with the versions of its constituent products (KB 314608) — Broadcom Knowledge Base

1. Patch Releases 9.1.1.x — Broadcom TechDocs

1. VMware Cloud Foundation 9.1 Frequently Asked Questions, 8 November 2026 — VMware by Broadcom

1. VCF 9.1 Product Support Notes — Broadcom TechDocs

1. Supported and Not Supported Configurations to Converge to VCF, 9.1 — Broadcom TechDocs

1. Upgrade vCenter and NSX Manager with an Optimized Maintenance Window, VCF 9.1 — Broadcom TechDocs

1. Upgrade Sequence to 9.1 — Broadcom TechDocs

1. How to Upgrade to VMware Cloud Foundation 9.1, 18 June 2026 — VMware Cloud Foundation Blog

1. Pre-Upgrade Tasks for Upgrading NSX, VCF 9.1 — Broadcom TechDocs

1. Upgrading vCenter and NSX Manager, VCF 9.1 — Broadcom TechDocs

1. Upgrade vCenter and NSX Manager Sequentially, VCF 9.1 — Broadcom TechDocs

1. Supported Components and Scenarios to Converge to VCF, 9.1 — Broadcom TechDocs

1. Upgrade VCF Operations to 9.1 — Broadcom TechDocs

1. Create Snapshots of the VCF Operations Nodes Before You Upgrade — Broadcom TechDocs

1. Back up Customized Content in VCF Operations Before an Upgrade — Broadcom TechDocs

1. Upgrading to VCF Operations 9.1 — Broadcom TechDocs

1. Import an Existing VMware Aria Automation Instance in VCF Operations — Broadcom TechDocs

1. Essential Prechecks for a Successful VMware Aria Automation 8.x upgrade to VCF Automation 9.x (KB 389563) — Broadcom Knowledge Base

1. Upgrading to VCF Automation 9.1 — Broadcom TechDocs

1. Upgrading to Log Management 9.1 — Broadcom TechDocs

1. Upgrading to VCF Operations for Networks 9.1 — Broadcom TechDocs

1. Upgrade VCF Operations Orchestrator to 9.1 — Broadcom TechDocs

1. Deploy VCF Management Services and License Server for the VCF Upgrade — Broadcom TechDocs