Migration
Which CMS versions lose vendor support in the next 12 months, and what does each date force?
Short answer
Four content management system (CMS) versions lose vendor support by 28 February 2027, on dates two vendor pages each confirm, as of October 2026: Drupal 10 on 9 December 2026 (Drupal.org), Umbraco 13 on 14 December 2026 (Umbraco), Kentico Xperience 13 on 31 December 2026 (Kentico) and Adobe Experience Manager 6.5 on-premises core support on 28 February 2027 (Adobe). Each forces a version decision.
- Drupal 10 end of life
- 9 December 2026, 46 days from 24 October 2026No Drupal 10 releases of any kind after that date; drupal.org says 10.6.x and 11.3.x security support ends the same week. Days are Deploi arithmeticSources: Drupal.org (Drupal core release schedule, Define explicit Drupal 10 end of life date)
- Umbraco 13 end of life
- 14 December 2026Its runtime, .NET 8, loses Microsoft support 34 days earlier, on 10 November 2026; Umbraco sells extended support for 6, 12 or 24 monthsSources: Umbraco (Long-term Support and End-of-Life, Umbraco 13 End-of-Life, Extended Long-Term Support for Umbraco 13); Umbraco Documentation (Umbraco 13 requirements); Microsoft (.NET and .NET Core official support policy, Microsoft .NET and .NET Core lifecycle)
- Kentico Xperience 13 end of support
- 31 December 2026From 1 January 2027 Kentico ceases all support, security repairs included; its lifecycle page lists no paid extensionSources: Kentico (Product Support Lifecycle, End of Support, Not End of the Story)
- AEM 6.5 on-premises core support
- Ends 28 February 2027Extended support, critical fixes only, runs to 28 February 2028; Adobe's roadmap says Service Pack 26, targeted for 19 November 2026, is the last planned 6.5 service packSources: Adobe Experience League (AEM 6.5 On-premise support timelines and service pack policy, Adobe Experience Manager releases roadmap, AEM 6.5 LTS Frequently Asked Questions); Adobe (Products and technical support periods)
Deploi’s call
Treat each date as a deadline for a version decision, not a reason to leave. Most of these vendors either name an upgrade path or sell time past the date. Drupal 10, Kentico Xperience 13 and Strapi 4 are hard stops, because their vendors list no extension, and Sitecore 10.0 and 10.1 are thinner than their dates suggest, because Sitecore says its Extended phase no longer includes security fixes by default.
UpgradeUpgrade your CMS to the vendor's supported version before the date when
- Your content management system (CMS) vendor names an upgrade path, such as Umbraco 13 to Umbraco 17 or Drupal 10.3.0 and later to Drupal 11, so you move before the date instead of paying for extended support after it.
- Your runtime loses support first, because Umbraco tells Umbraco 13 users to follow the .NET (Microsoft's application runtime) 8 supported versions, and .NET 8 support ends 10 November 2026.
- The vendor sells no extension, as with Kentico Xperience 13 per Kentico's lifecycle page as of October 2026, so 31 December 2026 is a hard stop for security repairs.
WaitBuy your CMS vendor's extended support past the date when
- A rebuild or replatform is funded and scheduled to launch after the date, so you need security coverage only until launch.
- The vendor offers a term that covers your launch: Umbraco XLTS (Extended Long-term Support) for 6, 12 or 24 months, or AEM (Adobe Experience Manager) 6.5 extended support to 28 February 2028, critical fixes only, as of October 2026.
- You hold the extension terms in writing, because Sitecore says its Extended phase has not included security fixes by default since 1 June 2026.
Which CMS versions lose vendor support before the end of 2026?
Four content management system (CMS) versions and two runtimes lose vendor support by 31 December 2026; this calendar covers 24 October 2026 to 24 October 2027. Drupal 10, Umbraco 13 and Kentico Xperience 13 end within 68 days, and Sitecore says extended support for Sitecore Experience Platform (XP) 10.0 and 10.1 ends 31 December 2026 (Sitecore, October 2026). Umbraco 13 runs on .NET (Microsoft's runtime) 8 (Umbraco Documentation, October 2026), so its runtime loses support first (Microsoft, October 2026). Our guide to leaving a legacy CMS sorts these dates into upgrades and moves.
| Version | End date | Days left | Vendor's next step |
|---|---|---|---|
| .NET 8 and 9 runtimes | 10 November 2026 | 17 | .NET 10 |
| Drupal 10 | 9 December 2026 | 46 | Drupal 11, in place from 10.3.0 |
| Umbraco 13 | 14 December 2026 | 51 | Umbraco 17, upgrade or rebuild |
| Kentico Xperience 13 | 31 December 2026 | 68 | Xperience by Kentico |
| Sitecore XP 10.0 and 10.1, Sitecore says | 31 December 2026 | 68 | Sustaining Support to 31 December 2028 |
| PHP 8.2 runtime, PHP says | 31 December 2026 | 68 | PHP 8.3 or later |
Which CMS versions lose support between January and October 2027?
Three content management system (CMS) versions lose support between 1 January and 24 October 2027. Adobe Experience Manager (AEM) 6.5 on premises loses core support on 28 February 2027, then critical fixes to 28 February 2028 (Adobe; Adobe support periods, October 2026). Umbraco says Umbraco 18 is security-only from 25 March 2027 (Umbraco, October 2026); Joomla 5 is security-only until 12 October 2027 (Joomla roadmap, October 2026).
| Version | End date | Days left | Source |
|---|---|---|---|
| AEM 6.5 core support | 28 February 2027 | 127 | Adobe, three pages |
| Umbraco 18 end of life | 25 June 2027 | 244 | Umbraco says |
| Joomla 5 security fixes | 12 October 2027 | 353 | Joomla, two pages |
What does end of support stop, vendor by vendor?
End of support stops different things at each content management system (CMS) vendor. Sitecore's change is the least obvious: since 1 June 2026, Sitecore says, security updates in its Extended phase are a "Contact your Sitecore Account Representative" item (Sitecore, October 2026). So a Sitecore 10.0 or 10.1 site has no security fixes by default in its last extended months. Optimizely has no end-of-life date at all and forces no upgrades (Optimizely CMS 13 FAQ; Optimizely release notes, October 2026).
| Vendor | Vendor's label | What stops on the date |
|---|---|---|
| Drupal | End of life | All Drupal 10 releases, security included |
| Umbraco | End-of-Life | Security patches, after a Security Phase of 12 months for long-term support versions, 3 for others |
| Kentico | End of Support | All support, security repairs included |
| Sitecore | Extended Support End Date | The Extended phase; Sitecore says its security fixes now sit with your account representative |
| Adobe | Core support, then extended support | Core support on the date; critical fixes end a year later |
| Strapi | EOL (end of life) | Security fixes for version 4 |
| Optimizely | No end-of-life date | Nothing on a date; CMS 11 gets no routine fixes |
Which CMS vendors sell more time after the date?
Four content management system (CMS) vendors sell, offer or certify more time past a date: Umbraco, Adobe, TYPO3 (the open-source CMS) and drupal.org for Drupal 7 (Umbraco; Adobe; TYPO3; Drupal.org, October 2026). Drupal 10, Kentico Xperience 13 and Strapi 4 get no extension on their vendors' pages, and Sitecore lists none for 10.0 and 10.1, so those dates are hard stops for security fixes.
| Version | What the vendor offers | What it covers |
|---|---|---|
| Umbraco 13 | Extended Long-term Support (XLTS) for 6, 12 or 24 months | Security patches; Umbraco says Cloud XLTS ends 14 December 2028 |
| Adobe Experience Manager 6.5 | Extended support to 28 February 2028 | Critical fixes only |
| Drupal 7 | HeroDevs or Tag1 Consulting, certified by drupal.org | Extended security support |
| TYPO3 v12.4 | Extended Long Term Support for up to three years, plus a fourth for partners only, TYPO3 says | Security and compatibility updates |
| Sitecore 10.0 and 10.1 | No security extension, Sitecore says | No security updates |
| Drupal 10 | None on drupal.org | No releases after 9 December 2026 |
| Kentico Xperience 13 | None on Kentico's lifecycle page | No security repairs from 1 January 2027 |
| Strapi 4 | None on Strapi's pages | Out of scope for vulnerability reports |
Which CMS versions already lost support in 2025 and 2026?
Thirteen content management system (CMS) deadlines passed between 1 January 2025 and 24 October 2026. Most ended all routine vendor fixes, but Sitecore 10.3 lost only mainstream support and TYPO3 (the open-source CMS) v12 only free support. The oldest is Drupal 7, which drupal.org stopped supporting on 5 January 2025 (Drupal.org; Drupal.org announcement, October 2026). Rows that rest on one vendor page say so.
| Version | Ended | Source |
|---|---|---|
| Drupal 7 | 5 January 2025 | drupal.org, two pages |
| Umbraco 8 | 24 February 2025 | Umbraco says |
| Umbraco 14 | 30 May 2025 | Umbraco says |
| Umbraco 10 | 16 June 2025 | Umbraco says |
| Joomla 4.4 | 14 October 2025 | Joomla says |
| Umbraco 15 | 14 November 2025 | Umbraco says |
| Sitecore 9.2 and 9.3 extended, 10.3 mainstream | 31 December 2025 | Sitecore says |
| Strapi 4 | 30 April 2026 | Strapi, two pages |
| Craft CMS 4 security support | 30 April 2026 | Craft CMS says |
| TYPO3 v12 free support | 30 April 2026 | TYPO3, two pages |
| Umbraco 16 | 12 June 2026 | Umbraco says |
| Drupal 10.5.x and 11.2.x security | Week of 29 June 2026 | drupal.org says |
| Adobe Experience Manager 6.5, Managed Services | By 31 August 2026 | Adobe says |
What does each CMS end-of-support date force you to decide?
Each end-of-support date forces a decision about one content management system (CMS) version, not a verdict on the platform. The vendor's next step sets the price of staying. Drupal 10.3.0 and later moves to Drupal 11 in place (Drupal.org upgrade guide, October 2026), while Kentico Xperience 13 moves to Xperience by Kentico through a Migration Toolkit (Kentico, October 2026), which is a bigger job. Run four checks before your date.
Four checks before a CMS end-of-support date
- Confirm the exact version. Record the major and the minor branch, because drupal.org ends 10.6.x and 11.3.x security support in the week of 7 December 2026 (Drupal.org, October 2026).
- Confirm the runtime date. Check the .NET (Microsoft's application runtime), PHP or Java version under the CMS, because .NET 8 ends on 10 November 2026 (Microsoft lifecycle, October 2026).
- Get extension terms in writing. Ask what the extension covers, for how long, and whether security fixes are included, because Sitecore says its Extended phase stopped including them by default on 1 June 2026 (Sitecore, October 2026).
- Take the upgrade or move decision. Upgrade in place where the vendor names a path; otherwise price staying against moving, then follow the plan for moving any CMS to Sanity if you leave.
Deploi’s point of view
- Where we disagree
- End-of-life roll-calls treat every vendor's date as the same event. It isn't. Kentico's end of support stops security repairs, Umbraco's end of life stops security patches but sells more time, Adobe's end of core support leaves a year of critical fixes, and Optimizely has no end-of-life date at all. The second mistake is copying dates from aggregators: one 2026 roll-call puts the end of Drupal 10.5 security support on 17 June 2026, while drupal.org's own schedule says the week of 29 June 2026.
- What this adds
- The decision guide gives the vendor-agnostic rule and the five nearest dates. This calendar gives the dated deadlines for the versions it covers from January 2025 to December 2027, what each vendor's label actually stops, which vendors sell more time and which don't, and the runtime date that lands before Umbraco 13's.
- How we keep this calendar
- Every date comes from the vendor's own page, opened on 24 October 2026, and from two vendor pages wherever two exist. A row that rests on one vendor page says so. We refresh the calendar every quarter and on any vendor announcement listed in the watch triggers.
- What we refuse to promise
- We don't quote extension prices, because the vendors don't publish them on the pages we cite, and we don't take dates from aggregators or agency lists. This calendar rests on the vendors' own documentation.
When this answer changes
- A vendor moves or extends a listed date: Drupal 10, Umbraco 13, Kentico Xperience 13 or AEM 6.5 core support
- Sitecore publishes a second page with 10.0 and 10.1 dates, or changes its support lifecycle article
- Adobe publishes an end date for AEM 6.5 LTS, or its pages agree on one
- Optimizely announces end-of-life dates for CMS versions
- Umbraco 19 ships, or misses, its 10 December 2026 release date
- The quarterly refresh, due January 2027
Sources
Every source opened and checked on 25 October 2026.
- Drupal.org, Drupal core release schedule
- Drupal.org, Define explicit Drupal 10 end of life date
- Drupal.org, Drupal 7 End of Life
- Drupal.org, End of life announcement and changes to Drupal 7 support
- Drupal.org, How to upgrade from Drupal 10 to Drupal 11
- Microsoft, .NET and .NET Core official support policy
- Microsoft, Microsoft .NET and .NET Core lifecycle
- Umbraco, Long-term Support and End-of-Life
- Umbraco, Umbraco 13 End-of-Life
- Umbraco, Extended Long-Term Support for Umbraco 13
- Umbraco Documentation, Umbraco 13 requirements
- Kentico, Product Support Lifecycle
- Kentico, End of Support, Not End of the Story
- Sitecore, Product Support Lifecycle (KB0641167)
- Sitecore, Navigating tomorrow: Sitecore's ongoing commitment to XP excellence
- Adobe Experience League, AEM 6.5 On-premise support timelines and service pack policy
- Adobe Experience League, Adobe Experience Manager releases roadmap
- Adobe Experience League, AEM 6.5 LTS Frequently Asked Questions
- Adobe, Products and technical support periods
- Strapi, Notice: Strapi v4 bug support coverage is ending in October
- Strapi, Security Policy (SECURITY.md)
- Optimizely, 2026 Optimizely CMS 12 release notes
- Optimizely, FAQs for CMS v13.0.0
- Joomla, Joomla! Project Roadmap
- Joomla, Joomla 5.4.10 Bugfix release
- Joomla, Joomla 5.3.4 Security and Bugfix Release
- Joomla, Joomla! 4.x Packages
- Craft CMS, Supported Versions
- TYPO3, TYPO3 v12 LTS End of Free Support
- TYPO3, Extended Long-Term Support (ELTS) for TYPO3 v12.4
- PHP, Supported Versions